From Coq Require Import Arith Bool List Lia Classical.
From Giskard Require Import lib structures local global prepare.
 
Import ListNotations.

Set Implicit Arguments.

Safety property two: Precommit stage height injectivity

Precommit stage definition

We say that a block is in precommit stage in some local state iff it is in prepare stage, and its child block is in prepare stage, i.e., it has received quorum PrepareVote messages or a PrepareQC message in the current view or some previous view.

Definition precommit_stage (tr : GTrace) (i : nat) (n : node) (b : block) :=
  exists b_child,
    parent_of b_child = b /\ 
    prepare_stage (fst (tr i) n) b /\  
    prepare_stage (fst (tr i) n) b_child.

Before we formally state the second safety property, we first motivate the definition of precommit stage and establish some facts about the relationship between prepare stage and precommit stage.

In particular, for a block to be in precommit stage we require that it is in prepare stage in that local state. In other words, the definition must satisfy that local precommit stage implies local prepare stage:

Lemma precommit_means_prepare :
  forall tr i b n,
    protocol_trace tr ->
    In n participants -> 
    precommit_stage tr i n b ->
    prepare_stage (fst (tr i) n) b.forall (tr : GTrace) (i : nat) (b : block) (n : node),
protocol_trace tr ->
In n participants ->
precommit_stage tr i n b ->
prepare_stage (fst (tr i) n) b 
Proof.forall (tr : GTrace) (i : nat) (b : block) (n : node),
protocol_trace tr ->
In n participants ->
precommit_stage tr i n b ->
prepare_stage (fst (tr i) n) b
  intros tr i b n H_prot H_part H_precommit.tr: GTrace
i: nat
b: block
n: node
H_prot: protocol_trace tr
H_part: In n participants
H_precommit: precommit_stage tr i n b
prepare_stage (fst (tr i) n) b
  destruct H_precommit as [b_child [H_parent [H_prepare_parent H_prepare_child]]].tr: GTrace
i: nat
b: block
n: node
H_prot: protocol_trace tr
H_part: In n participants
b_child: block
H_parent: parent_of b_child = b
H_prepare_parent: prepare_stage (fst (tr i) n) b
H_prepare_child: prepare_stage (fst (tr i) n) b_child
prepare_stage (fst (tr i) n) b
  destruct H_prepare_child as [v [H_past H_prepare_child]].tr: GTrace
i: nat
b: block
n: node
H_prot: protocol_trace tr
H_part: In n participants
b_child: block
H_parent: parent_of b_child = b
H_prepare_parent: prepare_stage (fst (tr i) n) b
v: nat
H_past: v <= node_view (fst (tr i) n)
H_prepare_child: prepare_stage_in_view (fst (tr i) n)
  v b_child
prepare_stage (fst (tr i) n) b 
  assumption. 
Qed.

We motivate this requirement below. Consider the following statement:

Definition prepare_stage_parent_prepare_stage :=
  forall tr i n b,
    protocol_trace tr ->
    In n participants -> 
    prepare_stage (fst (tr i) n) b ->
    prepare_stage (fst (tr i) n) (parent_of b).

While seemingly innocuous, this statement is false. This is evidenced by the following counterexample:

A, B, C and D are participating in the protocol, and blocks b1, b2 and b3 have been proposed.
A, B and C receive PrepareBlock messages for b1, and broadcast PrepareVote messages for b1.
A, B and C receive one another's PrepareVote(_, b1) messages, and respectively witness quorums for b1, broadcasting PrepareQC(_, b1) and PrepareVote(_, b2).
A receives PrepareVote(B, b2) and PrepareVote(C, b2) first, and alongside its own PrepareVote(A, b2), it witnesses a quorum for b2 and broadcasts PrepareQC (A, b2).

At this point, node D's input message buffer contains PrepareVote messages for b1 and b2, PrepareQC messages for b1, and PrepareQC(A, b1). In the case that D processes PrepareQC(A, b2) first, block b2 reaches prepare stage in D's local state, but b2's parent block, b1, has not reached prepare stage in D's local state, nor has D himself voted for either b1 or b2.

This counterexample further illustrates that the prepare stage status of a block in a local view is *independent of* whether the node has personally cast a vote for the block - if there are enough nodes in the protocol to form a quorum, a laggy node (e.g. node D in the example above) can simply sit idle and receive votes from others to enter blocks into prepare stage locally.

The converse, however, holds: if an honest node has personally cast a vote for some block, then the parent block must be at prepare stage locally:

Lemma sent_PrepareVote_means_parent_block_prepare_local :
  forall tr i n b p,
    protocol_trace tr ->
    In n participants ->
    honest_node n ->
    (* Node n has sent a PrepareVote for block b in view p *)
    In (mkMessage PrepareVote p n b GenesisBlock) (out_messages (fst (tr i) n)) ->
    (* The parent of block b must be in prepare stage, i.e. have received enough
       votes in the current or some past view. *)
    prepare_stage (fst (tr i) n) (parent_of b).forall (tr : GTrace) (i : nat) (n : node) (b : block)
  (p : nat),
protocol_trace tr ->
In n participants ->
honest_node n ->
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n)) ->
prepare_stage (fst (tr i) n) (parent_of b) 
Proof.forall (tr : GTrace) (i : nat) (n : node) (b : block)
  (p : nat),
protocol_trace tr ->
In n participants ->
honest_node n ->
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n)) ->
prepare_stage (fst (tr i) n) (parent_of b)
  intros tr i n b p H_prot H_part H_honest H_in.tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
prepare_stage (fst (tr i) n) (parent_of b)  
  induction i as [|i IH_prot].tr: GTrace
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr 0) n))
prepare_stage (fst (tr 0) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
IH_prot: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n)) ->
prepare_stage (fst (tr i) n) (parent_of b)
prepare_stage (fst (tr (S i)) n) (parent_of b) 
  -tr: GTrace
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr 0) n))
prepare_stage (fst (tr 0) n) (parent_of b) destruct H_prot as [H_init _];
      rewrite H_init in H_in;
      inversion H_in.
  -tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
IH_prot: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n)) ->
prepare_stage (fst (tr i) n) (parent_of b)
prepare_stage (fst (tr (S i)) n) (parent_of b) assert (H_view := view_same_or_plus_one i n H_prot H_part).tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
IH_prot: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n)) ->
prepare_stage (fst (tr i) n) (parent_of b)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
prepare_stage (fst (tr (S i)) n) (parent_of b)
    destruct (In_dec message_eq_dec (mkMessage PrepareVote p n b GenesisBlock)
     (out_messages (fst (tr i) n))) as [H_old | H_new].tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
IH_prot: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n)) ->
prepare_stage (fst (tr i) n) (parent_of b)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_old: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
IH_prot: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n)) ->
prepare_stage (fst (tr i) n) (parent_of b)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
prepare_stage (fst (tr (S i)) n) (parent_of b)
    +tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
IH_prot: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n)) ->
prepare_stage (fst (tr i) n) (parent_of b)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_old: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
prepare_stage (fst (tr (S i)) n) (parent_of b) spec IH_prot H_old.tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_old: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
IH_prot: prepare_stage (fst (tr i) n) (parent_of b)
prepare_stage (fst (tr (S i)) n) (parent_of b)
      destruct IH_prot as [p' [H_past H_prepare]].tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_old: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
p': nat
H_past: p' <= node_view (fst (tr i) n)
H_prepare: prepare_stage_in_view (fst (tr i) n) p'
  (parent_of b)
prepare_stage (fst (tr (S i)) n) (parent_of b) 
      exists p'; split; try tauto.tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_old: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
p': nat
H_past: p' <= node_view (fst (tr i) n)
H_prepare: prepare_stage_in_view (fst (tr i) n) p'
  (parent_of b)
p' <= node_view (fst (tr (S i)) n)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_old: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
p': nat
H_past: p' <= node_view (fst (tr i) n)
H_prepare: prepare_stage_in_view (fst (tr i) n) p'
  (parent_of b)
prepare_stage_in_view (fst (tr (S i)) n) p'
  (parent_of b)
      lia.tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_old: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
p': nat
H_past: p' <= node_view (fst (tr i) n)
H_prepare: prepare_stage_in_view (fst (tr i) n) p'
  (parent_of b)
prepare_stage_in_view (fst (tr (S i)) n) p'
  (parent_of b)
      apply prepare_in_view_persistent with i;
        try assumption;
        try lia. 
    +tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
IH_prot: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n)) ->
prepare_stage (fst (tr i) n) (parent_of b)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
prepare_stage (fst (tr (S i)) n) (parent_of b) clear IH_prot.tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
prepare_stage (fst (tr (S i)) n) (parent_of b)
      assert (H_prot_copy := H_prot); 
        destruct H_prot as [_ H_prot];
        spec H_prot i;
        destruct H_prot as [[n0 [H_in0 [p0 [msg0 [lm0 [H_step H_deliver]]]]]] | H_timeout].tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
prepare_stage (fst (tr (S i)) n) (parent_of b)
      * (* In the normal transition case *)tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        assert (H_sender : n0 = n).tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
n0 = n
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_sender: n0 = n
prepare_stage (fst (tr (S i)) n) (parent_of b)
        {tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
n0 = n apply out_message_change_tells_sender with tr i p0 msg0 lm0; try assumption.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
exists msg : message,
  In msg (out_messages (fst (tr (S i)) n)) /\
  ~ In msg (out_messages (fst (tr i) n))
          exists (mkMessage PrepareVote p n b GenesisBlock);
            tauto. }tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_sender: n0 = n
prepare_stage (fst (tr (S i)) n) (parent_of b) 
        rewrite H_sender in *.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n) msg0
  (fst (tr (S i)) n) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
prepare_stage (fst (tr (S i)) n) (parent_of b)
        destruct p0;
          assert (H_step_copy := H_step);
          destruct H_step as [H_update H_rest];
          rewrite H_update in H_in;
          simpl in H_in;
          try rewrite in_app_iff in H_in;
          repeat destruct H_in as [H_in | H_in];
          try contradiction;
          try discriminate.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        (* In the case of PrepareVote vote *)
        (* There must be a PrepareBlock *)
        unfold pending_PrepareVote in H_in.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |}
  (map
     (fun prepare_block_msg : message =>
      make_PrepareVote (fst (tr i) n) msg0
        prepare_block_msg)
     (filter
        (fun msg : message =>
         (get_view msg =? get_view msg0) &&
         negb
           (exists_same_height_blockb
              (fst (tr i) n) 
              (get_block msg)) &&
         parent_ofb (get_block msg)
           (get_block msg0) &&
         message_type_eqb
           (get_message_type msg) PrepareBlock)
        (counting_messages (fst (tr i) n))))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) 
        apply in_map_iff in H_in.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: exists x : message,
  make_PrepareVote (fst (tr i) n) msg0 x =
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} /\
  In x
    (filter
       (fun msg : message =>
        (get_view msg =? get_view msg0) &&
        negb
          (exists_same_height_blockb
             (fst (tr i) n) 
             (get_block msg)) &&
        parent_ofb (get_block msg)
          (get_block msg0) &&
        message_type_eqb 
          (get_message_type msg) PrepareBlock)
       (counting_messages (fst (tr i) n)))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        destruct H_in as [pb_msg [H_eq H_in]].tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg
  (filter
     (fun msg : message =>
      (get_view msg =? get_view msg0) &&
      negb
        (exists_same_height_blockb
           (fst (tr i) n) 
           (get_block msg)) &&
      parent_ofb (get_block msg)
        (get_block msg0) &&
      message_type_eqb (get_message_type msg)
        PrepareBlock)
     (counting_messages (fst (tr i) n)))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) 
        apply filter_In in H_in.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n)) /\
(get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) &&
parent_ofb (get_block pb_msg) (get_block msg0) &&
message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        destruct H_in as [H_in H_about].tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) &&
parent_ofb (get_block pb_msg)
  (get_block msg0) &&
message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        apply andb_prop in H_about.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) &&
parent_ofb (get_block pb_msg)
  (get_block msg0) = true /\
message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        destruct H_about as [H_about H_type].tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) &&
parent_ofb (get_block pb_msg)
  (get_block msg0) = true
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) 
        apply andb_prop in H_about.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true /\
parent_ofb (get_block pb_msg)
  (get_block msg0) = true
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        destruct H_about as [H_about H_parent].tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_ofb (get_block pb_msg)
  (get_block msg0) = true
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        apply parent_ofb_correct in H_parent.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        assert (parent_of b = get_block msg0).tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
parent_of b = get_block msg0
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        assert (get_block (make_PrepareVote (fst (tr i) n) msg0 pb_msg) =
         get_block (mkMessage PrepareVote p n b GenesisBlock)).tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
get_block
  (make_PrepareVote (fst (tr i) n) msg0 pb_msg) =
get_block
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |}
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: get_block
  (make_PrepareVote (fst (tr i) n) msg0 pb_msg) =
get_block
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |}
parent_of b = get_block msg0
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        {tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
get_block
  (make_PrepareVote (fst (tr i) n) msg0 pb_msg) =
get_block
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} apply f_equal.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|} easy. }tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: get_block
  (make_PrepareVote (fst (tr i) n) msg0 pb_msg) =
get_block
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |}
parent_of b = get_block msg0
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        unfold get_block in H.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: (let (_, _, _, get_block, _) :=
   make_PrepareVote (fst (tr i) n) msg0 pb_msg in
 get_block) = b
parent_of b = get_block msg0
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) simpl in H.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: get_block pb_msg = b
parent_of b = get_block msg0
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        rewrite <- H.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: get_block pb_msg = b
parent_of (get_block pb_msg) = get_block msg0
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) assumption.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) 
        rewrite H.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
prepare_stage (fst (tr (S i)) n) (get_block msg0)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) 
        rewrite H_update.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
prepare_stage
  (process
     (record_plural (fst (tr i) n)
        (make_PrepareQC (fst (tr i) n) msg0
         :: pending_PrepareVote (fst (tr i) n) msg0))
     msg0) (get_block msg0)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) 
        assert (H_prepare : vote_quorum_in_view (process (fst (tr i) n) msg0)
         (get_view msg0) (get_block msg0)) by tauto.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
H_prepare: vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
prepare_stage
  (process
     (record_plural (fst (tr i) n)
        (make_PrepareQC (fst (tr i) n) msg0
         :: pending_PrepareVote (fst (tr i) n) msg0))
     msg0) (get_block msg0)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) 
        exists (get_view msg0).tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
H_prepare: vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
get_view msg0 <=
node_view
  (process
     (record_plural (fst (tr i) n)
        (make_PrepareQC (fst (tr i) n) msg0
         :: pending_PrepareVote (fst (tr i) n) msg0))
     msg0) /\
prepare_stage_in_view
  (process
     (record_plural (fst (tr i) n)
        (make_PrepareQC (fst (tr i) n) msg0
         :: pending_PrepareVote (fst (tr i) n) msg0))
     msg0) (get_view msg0) 
  (get_block msg0)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)        split.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
H_prepare: vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
get_view msg0 <=
node_view
  (process
     (record_plural (fst (tr i) n)
        (make_PrepareQC (fst (tr i) n) msg0
         :: pending_PrepareVote (fst (tr i) n) msg0))
     msg0)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
H_prepare: vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
prepare_stage_in_view
  (process
     (record_plural (fst (tr i) n)
        (make_PrepareQC (fst (tr i) n) msg0
         :: pending_PrepareVote (fst (tr i) n) msg0))
     msg0) (get_view msg0) 
  (get_block msg0)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        simpl.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
H_prepare: vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
get_view msg0 <= node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
H_prepare: vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
prepare_stage_in_view
  (process
     (record_plural (fst (tr i) n)
        (make_PrepareQC (fst (tr i) n) msg0
         :: pending_PrepareVote (fst (tr i) n) msg0))
     msg0) (get_view msg0) 
  (get_block msg0)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) unfold view_valid in H_rest.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
H_prepare: vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
get_view msg0 <= node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
H_prepare: vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
prepare_stage_in_view
  (process
     (record_plural (fst (tr i) n)
        (make_PrepareQC (fst (tr i) n) msg0
         :: pending_PrepareVote (fst (tr i) n) msg0))
     msg0) (get_view msg0) 
  (get_block msg0)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) lia.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
H_prepare: vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
prepare_stage_in_view
  (process
     (record_plural (fst (tr i) n)
        (make_PrepareQC (fst (tr i) n) msg0
         :: pending_PrepareVote (fst (tr i) n) msg0))
     msg0) (get_view msg0) 
  (get_block msg0)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        left.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_rest: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
H_prepare: vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
vote_quorum_in_view
  (process
     (record_plural (fst (tr i) n)
        (make_PrepareQC (fst (tr i) n) msg0
         :: pending_PrepareVote (fst (tr i) n) msg0))
     msg0) (get_view msg0) 
  (get_block msg0)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) assumption.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)

        (* In the case of PrepareQC *) 
        unfold pending_PrepareVote in H_in.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |}
  (map
     (fun prepare_block_msg : message =>
      make_PrepareVote (fst (tr i) n) msg0
        prepare_block_msg)
     (filter
        (fun msg : message =>
         (get_view msg =? get_view msg0) &&
         negb
           (exists_same_height_blockb
              (fst (tr i) n) 
              (get_block msg)) &&
         parent_ofb (get_block msg)
           (get_block msg0) &&
         message_type_eqb
           (get_message_type msg) PrepareBlock)
        (counting_messages (fst (tr i) n))))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) 
        apply in_map_iff in H_in.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: exists x : message,
  make_PrepareVote (fst (tr i) n) msg0 x =
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} /\
  In x
    (filter
       (fun msg : message =>
        (get_view msg =? get_view msg0) &&
        negb
          (exists_same_height_blockb
             (fst (tr i) n) 
             (get_block msg)) &&
        parent_ofb (get_block msg)
          (get_block msg0) &&
        message_type_eqb 
          (get_message_type msg) PrepareBlock)
       (counting_messages (fst (tr i) n)))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        destruct H_in as [pb_msg [H_eq H_in]].tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg
  (filter
     (fun msg : message =>
      (get_view msg =? get_view msg0) &&
      negb
        (exists_same_height_blockb
           (fst (tr i) n) 
           (get_block msg)) &&
      parent_ofb (get_block msg)
        (get_block msg0) &&
      message_type_eqb (get_message_type msg)
        PrepareBlock)
     (counting_messages (fst (tr i) n)))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) 
        apply filter_In in H_in.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n)) /\
(get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) &&
parent_ofb (get_block pb_msg) (get_block msg0) &&
message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        destruct H_in as [H_in H_about].tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) &&
parent_ofb (get_block pb_msg)
  (get_block msg0) &&
message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        apply andb_prop in H_about.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) &&
parent_ofb (get_block pb_msg)
  (get_block msg0) = true /\
message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        destruct H_about as [H_about H_type].tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) &&
parent_ofb (get_block pb_msg)
  (get_block msg0) = true
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) 
        apply andb_prop in H_about.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true /\
parent_ofb (get_block pb_msg)
  (get_block msg0) = true
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        destruct H_about as [H_about H_parent].tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_ofb (get_block pb_msg)
  (get_block msg0) = true
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        apply parent_ofb_correct in H_parent.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        assert (parent_of b = get_block msg0).tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
parent_of b = get_block msg0
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        assert (get_block (make_PrepareVote (fst (tr i) n) msg0 pb_msg) =
         get_block (mkMessage PrepareVote p n b GenesisBlock)).tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
get_block
  (make_PrepareVote (fst (tr i) n) msg0 pb_msg) =
get_block
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |}
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: get_block
  (make_PrepareVote (fst (tr i) n) msg0 pb_msg) =
get_block
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |}
parent_of b = get_block msg0
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        {tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
get_block
  (make_PrepareVote (fst (tr i) n) msg0 pb_msg) =
get_block
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} apply f_equal.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|} easy. }tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: get_block
  (make_PrepareVote (fst (tr i) n) msg0 pb_msg) =
get_block
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |}
parent_of b = get_block msg0
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        unfold get_block in H.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: (let (_, _, _, get_block, _) :=
   make_PrepareVote (fst (tr i) n) msg0 pb_msg in
 get_block) = b
parent_of b = get_block msg0
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) simpl in H.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: get_block pb_msg = b
parent_of b = get_block msg0
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        rewrite <- H.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: get_block pb_msg = b
parent_of (get_block pb_msg) = get_block msg0
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) assumption.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
prepare_stage (fst (tr (S i)) n) (parent_of b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) 
        rewrite H.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
prepare_stage (fst (tr (S i)) n) (get_block msg0)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) 

        exists (node_view (fst (tr (S i)) n)).tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
node_view (fst (tr (S i)) n) <=
node_view (fst (tr (S i)) n) /\
prepare_stage_in_view (fst (tr (S i)) n)
  (node_view (fst (tr (S i)) n)) 
  (get_block msg0)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) split.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
node_view (fst (tr (S i)) n) <=
node_view (fst (tr (S i)) n)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
prepare_stage_in_view (fst (tr (S i)) n)
  (node_view (fst (tr (S i)) n)) 
  (get_block msg0)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) lia.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
prepare_stage_in_view (fst (tr (S i)) n)
  (node_view (fst (tr (S i)) n)) 
  (get_block msg0)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        rewrite H_update.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
prepare_stage_in_view
  (process
     (record_plural (fst (tr i) n)
        (pending_PrepareVote (fst (tr i) n) msg0))
     msg0)
  (node_view
     (process
        (record_plural (fst (tr i) n)
           (pending_PrepareVote (fst (tr i) n) msg0))
        msg0)) (get_block msg0)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) 
        right.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
PrepareQC_in_view
  (process
     (record_plural (fst (tr i) n)
        (pending_PrepareVote (fst (tr i) n) msg0))
     msg0)
  (node_view
     (process
        (record_plural (fst (tr i) n)
           (pending_PrepareVote (fst (tr i) n) msg0))
        msg0)) (get_block msg0)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) exists msg0.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
In msg0
  (counting_messages
     (process
        (record_plural (fst (tr i) n)
           (pending_PrepareVote (fst (tr i) n) msg0))
        msg0)) /\
get_view msg0 =
node_view
  (process
     (record_plural (fst (tr i) n)
        (pending_PrepareVote (fst (tr i) n) msg0))
     msg0) /\
get_block msg0 = get_block msg0 /\
get_message_type msg0 = PrepareQC
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) repeat split.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
In msg0
  (counting_messages
     (process
        (record_plural (fst (tr i) n)
           (pending_PrepareVote (fst (tr i) n) msg0))
        msg0))
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
get_view msg0 =
node_view
  (process
     (record_plural (fst (tr i) n)
        (pending_PrepareVote (fst (tr i) n) msg0))
     msg0)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
get_message_type msg0 = PrepareQC
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        simpl; tauto.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
get_view msg0 =
node_view
  (process
     (record_plural (fst (tr i) n)
        (pending_PrepareVote (fst (tr i) n) msg0))
     msg0)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
get_message_type msg0 = PrepareQC
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        unfold view_valid in H_rest.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
get_view msg0 =
node_view
  (process
     (record_plural (fst (tr i) n)
        (pending_PrepareVote (fst (tr i) n) msg0))
     msg0)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
get_message_type msg0 = PrepareQC
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)  simpl.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
get_message_type msg0 = PrepareQC
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        symmetry; tauto.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0, pb_msg: message
H_eq: make_PrepareVote (fst (tr i) n) msg0 pb_msg =
{|
  get_message_type := PrepareVote;
  get_view := p;
  get_sender := n;
  get_block := b;
  get_piggyback_block := GenesisBlock
|}
H_in: In pb_msg (counting_messages (fst (tr i) n))
H_about: (get_view pb_msg =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block pb_msg)) =
true
H_parent: parent_of (get_block pb_msg) =
get_block msg0
H_type: message_type_eqb (get_message_type pb_msg)
  PrepareBlock = true
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareQC_non_last_block_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
H: parent_of b = get_block msg0
get_message_type msg0 = PrepareQC
tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b) tauto.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        (* In the case of PrepareBlock malicious *)
        rewrite (protocol_trace_state_sane H_prot_copy) in H_rest.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
msg0: message
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (pending_PrepareVote (fst (tr i) n) msg0)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n participants
lm0: list message
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_rest: lm0 = pending_PrepareVote (fst (tr i) n) msg0 /\
received (fst (tr i) n) msg0 /\
~ honest_node n /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_sender: n0 = n
H_step_copy: get_transition
  process_PrepareBlock_malicious_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
prepare_stage (fst (tr (S i)) n) (parent_of b)
        tauto.
        
      * (* In the timeout case *)tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
prepare_stage (fst (tr (S i)) n) (parent_of b)
        rewrite H_timeout in H_in; simpl in H_in.tr: GTrace
i: nat
n: node
b: block
p: nat
H_part: In n participants
H_honest: honest_node n
H_in: In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (if is_member n participants
      then flip_timeout (fst (tr i) n)
      else fst (tr i) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~
In
  {|
    get_message_type := PrepareVote;
    get_view := p;
    get_sender := n;
    get_block := b;
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
prepare_stage (fst (tr (S i)) n) (parent_of b)
        apply is_member_correct in H_part;
          rewrite H_part in H_in; contradiction.
Qed.

However, the prepare stage status of blocks and the prepare stage status of their parent blocks are not unrelated - Giskard's criterion for voting states that nodes can only vote for blocks whose parent block has reached prepare stage. In other words, the criterion for voting in Giskard concerns what messages have been received, i.e., sent globally, but not what messages have been sent locally.

We can show that if a block is in prepare stage in some local state, then its parent block is in prepare stage in the global state, meaning that a quorum of votes must have been cast by all participating nodes, if not by itself. In the example above, when D processes PrepareQC(A, b2), it is certainly true that the global state has witnessed a quorum of PrepareVote messages for b1, even though D's local state has not. We formalize this notion of global prepare stage as follows.

Similar to prepare_stage_in_view, we first define a version of the global prepare stage definition which takes a particular view as a parameter. While local prepare stage definitions reason about local counting_message buffers, e.g., counting_messages (fst (tr i) n), global prepare stage definitions reason about the global message buffer snd (tr i):

Definition PrepareVote_about_block_in_view_global (tr : GTrace) i b p :=
  filter
    (fun msg =>
       message_type_eqb (get_message_type msg) PrepareVote &&
       block_eqb (get_block msg) b &&
       Nat.eqb (get_view msg) p)
    (snd (tr i)).

Definition vote_quorum_in_view_global tr i b p :=
  quorum (PrepareVote_about_block_in_view_global tr i b p). 

Definition PrepareQC_in_view_global (tr : GTrace) i b p :=
  exists msg : message,
    In msg (snd (tr i)) /\
    get_view msg = p /\
    get_block msg = b /\
    get_message_type msg = PrepareQC.

Similar to local prepare stage prepare_stage_in_view, we define global prepare stage in some view as the disjunction of the two cases: in that view, either the block has received a quorum of PrepareVote messages, or it has received a PrepareQC message:

Definition prepare_stage_in_view_global tr i b p :=
  vote_quorum_in_view_global tr i b p \/
  PrepareQC_in_view_global tr i b p.

The property of being in local prepare stage is persistent: once a block reaches prepare stage in some local state, it remains in prepare stage for all future states of that node:

Lemma prepare_stage_persistent :
  forall tr : GTrace,
    protocol_trace tr ->
    forall (n : node) (i : nat),
      In n participants ->
      forall (b : block),
        prepare_stage (fst (tr i) n) b ->
        forall j : nat, i <= j ->
          prepare_stage (fst (tr j) n) b.forall tr : GTrace,
protocol_trace tr ->
forall (n : node) (i : nat),
In n participants ->
forall b : block,
prepare_stage (fst (tr i) n) b ->
forall j : nat,
i <= j -> prepare_stage (fst (tr j) n) b 
Proof.forall tr : GTrace,
protocol_trace tr ->
forall (n : node) (i : nat),
In n participants ->
forall b : block,
prepare_stage (fst (tr i) n) b ->
forall j : nat,
i <= j -> prepare_stage (fst (tr j) n) b
  intros tr H_prot n i H_part b H_prepare j H_past.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
b: block
H_prepare: prepare_stage (fst (tr i) n) b
j: nat
H_past: i <= j
prepare_stage (fst (tr j) n) b
  destruct H_prepare as [v' [H_past' H_prepare]].tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
b: block
v': nat
H_past': v' <= node_view (fst (tr i) n)
H_prepare: prepare_stage_in_view (fst (tr i) n) v' b
j: nat
H_past: i <= j
prepare_stage (fst (tr j) n) b
  exists v'.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
b: block
v': nat
H_past': v' <= node_view (fst (tr i) n)
H_prepare: prepare_stage_in_view (fst (tr i) n) v' b
j: nat
H_past: i <= j
v' <= node_view (fst (tr j) n) /\
prepare_stage_in_view (fst (tr j) n) v' b split.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
b: block
v': nat
H_past': v' <= node_view (fst (tr i) n)
H_prepare: prepare_stage_in_view (fst (tr i) n) v' b
j: nat
H_past: i <= j
v' <= node_view (fst (tr j) n)
tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
b: block
v': nat
H_past': v' <= node_view (fst (tr i) n)
H_prepare: prepare_stage_in_view (fst (tr i) n) v' b
j: nat
H_past: i <= j
prepare_stage_in_view (fst (tr j) n) v' b
  assert (H_useful := view_state_morphism).tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
b: block
v': nat
H_past': v' <= node_view (fst (tr i) n)
H_prepare: prepare_stage_in_view (fst (tr i) n) v' b
j: nat
H_past: i <= j
H_useful: forall tr : GTrace,
protocol_trace tr ->
forall (i1 i2 : nat) (n : node),
In n participants ->
i1 <= i2 ->
node_view (fst (tr i1) n) <=
node_view (fst (tr i2) n)
v' <= node_view (fst (tr j) n)
tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
b: block
v': nat
H_past': v' <= node_view (fst (tr i) n)
H_prepare: prepare_stage_in_view (fst (tr i) n) v' b
j: nat
H_past: i <= j
prepare_stage_in_view (fst (tr j) n) v' b
  spec H_useful tr H_prot i j n H_part H_past.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
b: block
v': nat
H_past': v' <= node_view (fst (tr i) n)
H_prepare: prepare_stage_in_view (fst (tr i) n) v' b
j: nat
H_past: i <= j
H_useful: node_view (fst (tr i) n) <=
node_view (fst (tr j) n)
v' <= node_view (fst (tr j) n)
tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
b: block
v': nat
H_past': v' <= node_view (fst (tr i) n)
H_prepare: prepare_stage_in_view (fst (tr i) n) v' b
j: nat
H_past: i <= j
prepare_stage_in_view (fst (tr j) n) v' b lia.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
b: block
v': nat
H_past': v' <= node_view (fst (tr i) n)
H_prepare: prepare_stage_in_view (fst (tr i) n) v' b
j: nat
H_past: i <= j
prepare_stage_in_view (fst (tr j) n) v' b
  now apply prepare_in_view_persistent with i.
Qed.

We can prove a similar fact for prepare_stage_in_view_global.

Lemma prepare_stage_in_view_step_global :
  forall tr i b p,
    protocol_trace tr ->
    prepare_stage_in_view_global tr i b p -> 
    prepare_stage_in_view_global tr (S i) b p.forall (tr : GTrace) (i : nat) (b : block) (p : nat),
protocol_trace tr ->
prepare_stage_in_view_global tr i b p ->
prepare_stage_in_view_global tr (S i) b p 
Proof.forall (tr : GTrace) (i : nat) (b : block) (p : nat),
protocol_trace tr ->
prepare_stage_in_view_global tr i b p ->
prepare_stage_in_view_global tr (S i) b p
  intros tr i b p H_prot H_prepare.tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_prepare: prepare_stage_in_view_global tr i b p
prepare_stage_in_view_global tr (S i) b p
  destruct H_prepare as [H_vote | H_qc].tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_vote: vote_quorum_in_view_global tr i b p
prepare_stage_in_view_global tr (S i) b p
tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr (S i) b p
  left.tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_vote: vote_quorum_in_view_global tr i b p
vote_quorum_in_view_global tr (S i) b p
tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr (S i) b p
  unfold vote_quorum_in_view_global in H_vote.tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
vote_quorum_in_view_global tr (S i) b p
tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr (S i) b p
  red.tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
quorum
  (PrepareVote_about_block_in_view_global tr (S i) b p)
tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr (S i) b p 
  apply quorum_subset with (PrepareVote_about_block_in_view_global tr i b p).tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
quorum
  (PrepareVote_about_block_in_view_global tr i b p)
tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
forall msg : message,
In msg
  (PrepareVote_about_block_in_view_global tr i b p) ->
In msg
  (PrepareVote_about_block_in_view_global tr (S i) b p)
tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr (S i) b p
  assumption.tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
forall msg : message,
In msg
  (PrepareVote_about_block_in_view_global tr i b p) ->
In msg
  (PrepareVote_about_block_in_view_global tr (S i) b p)
tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr (S i) b p intros.tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
msg: message
H: In msg
  (PrepareVote_about_block_in_view_global tr i b p)
In msg
  (PrepareVote_about_block_in_view_global tr (S i) b p)
tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr (S i) b p
  apply filter_In in H.tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
msg: message
H: In msg (snd (tr i)) /\
message_type_eqb (get_message_type msg)
  PrepareVote && block_eqb (get_block msg) b &&
(get_view msg =? p) = true
In msg
  (PrepareVote_about_block_in_view_global tr (S i) b p)
tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr (S i) b p apply filter_In.tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
msg: message
H: In msg (snd (tr i)) /\
message_type_eqb (get_message_type msg)
  PrepareVote && block_eqb (get_block msg) b &&
(get_view msg =? p) = true
In msg (snd (tr (S i))) /\
message_type_eqb (get_message_type msg) PrepareVote &&
block_eqb (get_block msg) b && 
(get_view msg =? p) = true
tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr (S i) b p
  split.tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
msg: message
H: In msg (snd (tr i)) /\
message_type_eqb (get_message_type msg)
  PrepareVote && block_eqb (get_block msg) b &&
(get_view msg =? p) = true
In msg (snd (tr (S i)))
tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
msg: message
H: In msg (snd (tr i)) /\
message_type_eqb (get_message_type msg)
  PrepareVote && block_eqb (get_block msg) b &&
(get_view msg =? p) = true
message_type_eqb (get_message_type msg) PrepareVote &&
block_eqb (get_block msg) b && 
(get_view msg =? p) = true
tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr (S i) b p destruct H.tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
msg: message
H: In msg (snd (tr i))
H0: message_type_eqb (get_message_type msg)
  PrepareVote && block_eqb (get_block msg) b &&
(get_view msg =? p) = true
In msg (snd (tr (S i)))
tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
msg: message
H: In msg (snd (tr i)) /\
message_type_eqb (get_message_type msg)
  PrepareVote && block_eqb (get_block msg) b &&
(get_view msg =? p) = true
message_type_eqb (get_message_type msg) PrepareVote &&
block_eqb (get_block msg) b && 
(get_view msg =? p) = true
tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr (S i) b p now apply global_messages_monotonic_step.tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
msg: message
H: In msg (snd (tr i)) /\
message_type_eqb (get_message_type msg)
  PrepareVote && block_eqb (get_block msg) b &&
(get_view msg =? p) = true
message_type_eqb (get_message_type msg) PrepareVote &&
block_eqb (get_block msg) b && 
(get_view msg =? p) = true
tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr (S i) b p
  tauto.tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr (S i) b p
  right.tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_qc: PrepareQC_in_view_global tr i b p
PrepareQC_in_view_global tr (S i) b p destruct H_qc as [msg [H1 [H2 H3]]].tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
msg: message
H1: In msg (snd (tr i))
H2: get_view msg = p
H3: get_block msg = b /\
get_message_type msg = PrepareQC
PrepareQC_in_view_global tr (S i) b p
  exists msg; repeat split; try tauto.tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
msg: message
H1: In msg (snd (tr i))
H2: get_view msg = p
H3: get_block msg = b /\
get_message_type msg = PrepareQC
In msg (snd (tr (S i)))
  now apply global_messages_monotonic_step.
Qed.

Lemma prepare_stage_in_view_persistent_global :
  forall tr i j b p,
    protocol_trace tr ->
    i < j -> 
    prepare_stage_in_view_global tr i b p -> 
    prepare_stage_in_view_global tr j b p.forall (tr : GTrace) (i j : nat) (b : block) (p : nat),
protocol_trace tr ->
i < j ->
prepare_stage_in_view_global tr i b p ->
prepare_stage_in_view_global tr j b p 
Proof.forall (tr : GTrace) (i j : nat) (b : block) (p : nat),
protocol_trace tr ->
i < j ->
prepare_stage_in_view_global tr i b p ->
prepare_stage_in_view_global tr j b p
  intros tr i j b p H_prot H_past H_prepare.tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_prepare: prepare_stage_in_view_global tr i b p
prepare_stage_in_view_global tr j b p
  destruct H_prepare as [H_vote | H_qc].tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_vote: vote_quorum_in_view_global tr i b p
prepare_stage_in_view_global tr j b p
tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr j b p
  left.tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_vote: vote_quorum_in_view_global tr i b p
vote_quorum_in_view_global tr j b p
tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr j b p
  unfold vote_quorum_in_view_global in H_vote.tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
vote_quorum_in_view_global tr j b p
tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr j b p
  red.tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
quorum
  (PrepareVote_about_block_in_view_global tr j b p)
tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr j b p 
  apply quorum_subset with (PrepareVote_about_block_in_view_global tr i b p).tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
quorum
  (PrepareVote_about_block_in_view_global tr i b p)
tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
forall msg : message,
In msg
  (PrepareVote_about_block_in_view_global tr i b p) ->
In msg
  (PrepareVote_about_block_in_view_global tr j b p)
tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr j b p
  assumption.tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
forall msg : message,
In msg
  (PrepareVote_about_block_in_view_global tr i b p) ->
In msg
  (PrepareVote_about_block_in_view_global tr j b p)
tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr j b p intros.tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
msg: message
H: In msg
  (PrepareVote_about_block_in_view_global tr i b p)
In msg
  (PrepareVote_about_block_in_view_global tr j b p)
tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr j b p
  apply filter_In in H.tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
msg: message
H: In msg (snd (tr i)) /\
message_type_eqb (get_message_type msg)
  PrepareVote && block_eqb (get_block msg) b &&
(get_view msg =? p) = true
In msg
  (PrepareVote_about_block_in_view_global tr j b p)
tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr j b p apply filter_In.tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
msg: message
H: In msg (snd (tr i)) /\
message_type_eqb (get_message_type msg)
  PrepareVote && block_eqb (get_block msg) b &&
(get_view msg =? p) = true
In msg (snd (tr j)) /\
message_type_eqb (get_message_type msg) PrepareVote &&
block_eqb (get_block msg) b && 
(get_view msg =? p) = true
tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr j b p
  split.tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
msg: message
H: In msg (snd (tr i)) /\
message_type_eqb (get_message_type msg)
  PrepareVote && block_eqb (get_block msg) b &&
(get_view msg =? p) = true
In msg (snd (tr j))
tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
msg: message
H: In msg (snd (tr i)) /\
message_type_eqb (get_message_type msg)
  PrepareVote && block_eqb (get_block msg) b &&
(get_view msg =? p) = true
message_type_eqb (get_message_type msg) PrepareVote &&
block_eqb (get_block msg) b && 
(get_view msg =? p) = true
tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr j b p destruct H.tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
msg: message
H: In msg (snd (tr i))
H0: message_type_eqb (get_message_type msg)
  PrepareVote && block_eqb (get_block msg) b &&
(get_view msg =? p) = true
In msg (snd (tr j))
tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
msg: message
H: In msg (snd (tr i)) /\
message_type_eqb (get_message_type msg)
  PrepareVote && block_eqb (get_block msg) b &&
(get_view msg =? p) = true
message_type_eqb (get_message_type msg) PrepareVote &&
block_eqb (get_block msg) b && 
(get_view msg =? p) = true
tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr j b p now apply global_messages_monotonic with i.tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_vote: quorum
  (PrepareVote_about_block_in_view_global tr
     i b p)
msg: message
H: In msg (snd (tr i)) /\
message_type_eqb (get_message_type msg)
  PrepareVote && block_eqb (get_block msg) b &&
(get_view msg =? p) = true
message_type_eqb (get_message_type msg) PrepareVote &&
block_eqb (get_block msg) b && 
(get_view msg =? p) = true
tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr j b p
  tauto.tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_qc: PrepareQC_in_view_global tr i b p
prepare_stage_in_view_global tr j b p
  right.tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
H_qc: PrepareQC_in_view_global tr i b p
PrepareQC_in_view_global tr j b p destruct H_qc as [msg [H1 [H2 H3]]].tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
msg: message
H1: In msg (snd (tr i))
H2: get_view msg = p
H3: get_block msg = b /\
get_message_type msg = PrepareQC
PrepareQC_in_view_global tr j b p
  exists msg; repeat split; try tauto.tr: GTrace
i, j: nat
b: block
p: nat
H_prot: protocol_trace tr
H_past: i < j
msg: message
H1: In msg (snd (tr i))
H2: get_view msg = p
H3: get_block msg = b /\
get_message_type msg = PrepareQC
In msg (snd (tr j))
  now apply global_messages_monotonic with i.
Qed.

The following fact follows directly from the definition of prepare_stage_in_view_global:

Lemma prepare_in_view_means_PrepareVote_PrepareQC_exists_global : 
  forall tr i,
    protocol_trace tr ->
    forall (b : block) (x : nat),
      prepare_stage_in_view_global tr i b x ->
      exists (msg1 : message),
        In msg1 (snd (tr i)) /\
        get_view msg1 = x /\
        get_block msg1 = b /\ 
        (get_message_type msg1 = PrepareVote \/
         get_message_type msg1 = PrepareQC).forall (tr : GTrace) (i : nat),
protocol_trace tr ->
forall (b : block) (x : nat),
prepare_stage_in_view_global tr i b x ->
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC) 
Proof.forall (tr : GTrace) (i : nat),
protocol_trace tr ->
forall (b : block) (x : nat),
prepare_stage_in_view_global tr i b x ->
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
  intros tr i H_prot b x H_prepare.tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
H_prepare: prepare_stage_in_view_global tr i b x
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
  destruct H_prepare as [H_quorum | H_qc].tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
H_quorum: vote_quorum_in_view_global tr i b x
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
H_qc: PrepareQC_in_view_global tr i b x
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC) 
  -tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
H_quorum: vote_quorum_in_view_global tr i b x
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC) apply empty_has_no_two_thirds' in H_quorum.tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
H_quorum: exists n : node,
  In n
    (map get_sender
       (PrepareVote_about_block_in_view_global
          tr i b x))
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    destruct H_quorum as [n H_in].tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
H_in: In n
  (map get_sender
     (PrepareVote_about_block_in_view_global tr
        i b x))
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    apply in_map_iff in H_in.tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
H_in: exists x0 : message,
  get_sender x0 = n /\
  In x0
    (PrepareVote_about_block_in_view_global tr
       i b x)
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    destruct H_in as [msg [H_sender H_in]].tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
msg: message
H_sender: get_sender msg = n
H_in: In msg
  (PrepareVote_about_block_in_view_global tr i
     b x)
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    apply filter_In in H_in.tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
msg: message
H_sender: get_sender msg = n
H_in: In msg (snd (tr i)) /\
message_type_eqb (get_message_type msg)
  PrepareVote && block_eqb (get_block msg) b &&
(get_view msg =? x) = true
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC) 
    destruct H_in as [H_in H_typeblockview].tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
msg: message
H_sender: get_sender msg = n
H_in: In msg (snd (tr i))
H_typeblockview: message_type_eqb
  (get_message_type msg) PrepareVote &&
block_eqb (get_block msg) b &&
(get_view msg =? x) = true
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    apply andb_true_iff in H_typeblockview.tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
msg: message
H_sender: get_sender msg = n
H_in: In msg (snd (tr i))
H_typeblockview: message_type_eqb
  (get_message_type msg) PrepareVote &&
block_eqb (get_block msg) b = true /\
(get_view msg =? x) = true
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    destruct H_typeblockview as [H_typeblock H_view].tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
msg: message
H_sender: get_sender msg = n
H_in: In msg (snd (tr i))
H_typeblock: message_type_eqb (get_message_type msg)
  PrepareVote &&
block_eqb (get_block msg) b = true
H_view: (get_view msg =? x) = true
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    apply andb_prop in H_typeblock.tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
msg: message
H_sender: get_sender msg = n
H_in: In msg (snd (tr i))
H_typeblock: message_type_eqb (get_message_type msg)
  PrepareVote = true /\
block_eqb (get_block msg) b = true
H_view: (get_view msg =? x) = true
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC) 
    destruct H_typeblock as [H_type H_block].tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
msg: message
H_sender: get_sender msg = n
H_in: In msg (snd (tr i))
H_type: message_type_eqb (get_message_type msg)
  PrepareVote = true
H_block: block_eqb (get_block msg) b = true
H_view: (get_view msg =? x) = true
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    apply message_type_eqb_correct in H_type.tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
msg: message
H_sender: get_sender msg = n
H_in: In msg (snd (tr i))
H_type: get_message_type msg = PrepareVote
H_block: block_eqb (get_block msg) b = true
H_view: (get_view msg =? x) = true
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    apply Nat.eqb_eq in H_view.tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
msg: message
H_sender: get_sender msg = n
H_in: In msg (snd (tr i))
H_type: get_message_type msg = PrepareVote
H_block: block_eqb (get_block msg) b = true
H_view: get_view msg = x
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    apply block_eqb_correct in H_block.tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
msg: message
H_sender: get_sender msg = n
H_in: In msg (snd (tr i))
H_type: get_message_type msg = PrepareVote
H_block: get_block msg = b
H_view: get_view msg = x
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    exists msg; repeat split; try tauto.
  -tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
H_qc: PrepareQC_in_view_global tr i b x
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC) destruct H_qc as [msg H_qc].tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
msg: message
H_qc: In msg (snd (tr i)) /\
get_view msg = x /\
get_block msg = b /\
get_message_type msg = PrepareQC
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    exists msg; repeat split; try tauto.
Qed.

We can then define prepare_stage_global using prepare_stage_in_view_global, similar to how we defined prepare_stage using prepare_stage_in_view:

Definition prepare_stage_global tr i b :=
  exists p, prepare_stage_in_view_global tr i b p.

We can easily establish the relationship between local and global prepare stages through the relationship between local out_messages buffers and the global message buffer. One is strictly stronger: we can prove global from local, but not vice versa:

Lemma prepare_stage_in_view_means_prepare_stage_in_view_global :
  forall tr i n b p,
    protocol_trace tr ->
    In n participants -> 
    prepare_stage_in_view (fst (tr i) n) p b ->
    prepare_stage_in_view_global tr i b p.forall (tr : GTrace) (i : nat) (n : node) (b : block)
  (p : nat),
protocol_trace tr ->
In n participants ->
prepare_stage_in_view (fst (tr i) n) p b ->
prepare_stage_in_view_global tr i b p
Proof.forall (tr : GTrace) (i : nat) (n : node) (b : block)
  (p : nat),
protocol_trace tr ->
In n participants ->
prepare_stage_in_view (fst (tr i) n) p b ->
prepare_stage_in_view_global tr i b p
  intros tr i n b p H_prot H_part H_local.tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_local: prepare_stage_in_view (fst (tr i) n) p b
prepare_stage_in_view_global tr i b p
  destruct H_local as [H_vote | H_qc].tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_vote: vote_quorum_in_view (fst (tr i) n) p b
prepare_stage_in_view_global tr i b p
tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_qc: PrepareQC_in_view (fst (tr i) n) p b
prepare_stage_in_view_global tr i b p 
  -tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_vote: vote_quorum_in_view (fst (tr i) n) p b
prepare_stage_in_view_global tr i b p left.tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_vote: vote_quorum_in_view (fst (tr i) n) p b
vote_quorum_in_view_global tr i b p
    unfold vote_quorum_in_view in H_vote.tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_vote: quorum
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b)
vote_quorum_in_view_global tr i b p
    red.tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_vote: quorum
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b)
quorum
  (PrepareVote_about_block_in_view_global tr i b p)
    unfold quorum in *.tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_vote: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (fst (tr i) n) p b))
has_at_least_two_thirds
  (map get_sender
     (PrepareVote_about_block_in_view_global tr i b p))
    apply quorum_subset with (processed_PrepareVote_in_view_about_block
                   (fst (tr i) n) p b).tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_vote: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (fst (tr i) n) p b))
quorum
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b)
tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_vote: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (fst (tr i) n) p b))
forall msg : message,
In msg
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b) ->
In msg
  (PrepareVote_about_block_in_view_global tr i b p)
    assumption.tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_vote: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (fst (tr i) n) p b))
forall msg : message,
In msg
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b) ->
In msg
  (PrepareVote_about_block_in_view_global tr i b p) 
    intros msg0 H_in0.tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_vote: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (fst (tr i) n) p b))
msg0: message
H_in0: In msg0
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b)
In msg0
  (PrepareVote_about_block_in_view_global tr i b p)
    apply filter_In in H_in0.tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_vote: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (fst (tr i) n) p b))
msg0: message
H_in0: In msg0 (counting_messages (fst (tr i) n)) /\
message_type_eqb (get_message_type msg0)
  PrepareVote && block_eqb (get_block msg0) b &&
(get_view msg0 =? p) = true
In msg0
  (PrepareVote_about_block_in_view_global tr i b p)
    destruct H_in0 as [H_in0 H_rest0].tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_vote: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (fst (tr i) n) p b))
msg0: message
H_in0: In msg0 (counting_messages (fst (tr i) n))
H_rest0: message_type_eqb (get_message_type msg0)
  PrepareVote &&
block_eqb (get_block msg0) b &&
(get_view msg0 =? p) = true
In msg0
  (PrepareVote_about_block_in_view_global tr i b p)
    apply filter_In.tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_vote: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (fst (tr i) n) p b))
msg0: message
H_in0: In msg0 (counting_messages (fst (tr i) n))
H_rest0: message_type_eqb (get_message_type msg0)
  PrepareVote &&
block_eqb (get_block msg0) b &&
(get_view msg0 =? p) = true
In msg0 (snd (tr i)) /\
message_type_eqb (get_message_type msg0) PrepareVote &&
block_eqb (get_block msg0) b && 
(get_view msg0 =? p) = true split.tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_vote: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (fst (tr i) n) p b))
msg0: message
H_in0: In msg0 (counting_messages (fst (tr i) n))
H_rest0: message_type_eqb (get_message_type msg0)
  PrepareVote &&
block_eqb (get_block msg0) b &&
(get_view msg0 =? p) = true
In msg0 (snd (tr i))
tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_vote: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (fst (tr i) n) p b))
msg0: message
H_in0: In msg0 (counting_messages (fst (tr i) n))
H_rest0: message_type_eqb (get_message_type msg0)
  PrepareVote &&
block_eqb (get_block msg0) b &&
(get_view msg0 =? p) = true
message_type_eqb (get_message_type msg0) PrepareVote &&
block_eqb (get_block msg0) b && 
(get_view msg0 =? p) = true
    apply processed_means_sent_global with n; try assumption.tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_vote: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (fst (tr i) n) p b))
msg0: message
H_in0: In msg0 (counting_messages (fst (tr i) n))
H_rest0: message_type_eqb (get_message_type msg0)
  PrepareVote &&
block_eqb (get_block msg0) b &&
(get_view msg0 =? p) = true
message_type_eqb (get_message_type msg0) PrepareVote &&
block_eqb (get_block msg0) b && 
(get_view msg0 =? p) = true
    tauto. 
  -tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_qc: PrepareQC_in_view (fst (tr i) n) p b
prepare_stage_in_view_global tr i b p right.tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
H_qc: PrepareQC_in_view (fst (tr i) n) p b
PrepareQC_in_view_global tr i b p
    destruct H_qc as [msg [H_in H_rest]].tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
msg: message
H_in: In msg (counting_messages (fst (tr i) n))
H_rest: get_view msg = p /\
get_block msg = b /\
get_message_type msg = PrepareQC
PrepareQC_in_view_global tr i b p
    exists msg; split.tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
msg: message
H_in: In msg (counting_messages (fst (tr i) n))
H_rest: get_view msg = p /\
get_block msg = b /\
get_message_type msg = PrepareQC
In msg (snd (tr i))
tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
msg: message
H_in: In msg (counting_messages (fst (tr i) n))
H_rest: get_view msg = p /\
get_block msg = b /\
get_message_type msg = PrepareQC
get_view msg = p /\
get_block msg = b /\ get_message_type msg = PrepareQC
    apply processed_means_sent_global with n; try assumption.tr: GTrace
i: nat
n: node
b: block
p: nat
H_prot: protocol_trace tr
H_part: In n participants
msg: message
H_in: In msg (counting_messages (fst (tr i) n))
H_rest: get_view msg = p /\
get_block msg = b /\
get_message_type msg = PrepareQC
get_view msg = p /\
get_block msg = b /\ get_message_type msg = PrepareQC
    tauto.
Qed.

Lemma prepare_stage_means_prepare_stage_global :
  forall tr i n b,
    protocol_trace tr ->
    In n participants -> 
    prepare_stage (fst (tr i) n) b ->
    prepare_stage_global tr i b.forall (tr : GTrace) (i : nat) (n : node) (b : block),
protocol_trace tr ->
In n participants ->
prepare_stage (fst (tr i) n) b ->
prepare_stage_global tr i b
Proof.forall (tr : GTrace) (i : nat) (n : node) (b : block),
protocol_trace tr ->
In n participants ->
prepare_stage (fst (tr i) n) b ->
prepare_stage_global tr i b
  intros tr i n b H_prot H_part H_local.tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
H_local: prepare_stage (fst (tr i) n) b
prepare_stage_global tr i b
  destruct H_local as [v' [H_past [H_vote | H_qc]]];
  exists v'.tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
H_vote: vote_quorum_in_view (fst (tr i) n) v' b
prepare_stage_in_view_global tr i b v'
tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
H_qc: PrepareQC_in_view (fst (tr i) n) v' b
prepare_stage_in_view_global tr i b v'
  -tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
H_vote: vote_quorum_in_view (fst (tr i) n) v' b
prepare_stage_in_view_global tr i b v' left.tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
H_vote: vote_quorum_in_view (fst (tr i) n) v' b
vote_quorum_in_view_global tr i b v'
    unfold vote_quorum_in_view in H_vote.tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
H_vote: quorum
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) v' b)
vote_quorum_in_view_global tr i b v'
    red.tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
H_vote: quorum
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) v' b)
quorum
  (PrepareVote_about_block_in_view_global tr i b v')
    unfold quorum in *.tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
H_vote: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (fst (tr i) n) v' b))
has_at_least_two_thirds
  (map get_sender
     (PrepareVote_about_block_in_view_global tr i b v'))
    apply quorum_subset with (processed_PrepareVote_in_view_about_block
                   (fst (tr i) n) v' b).tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
H_vote: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (fst (tr i) n) v' b))
quorum
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) v' b)
tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
H_vote: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (fst (tr i) n) v' b))
forall msg : message,
In msg
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) v' b) ->
In msg
  (PrepareVote_about_block_in_view_global tr i b v')
    assumption.tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
H_vote: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (fst (tr i) n) v' b))
forall msg : message,
In msg
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) v' b) ->
In msg
  (PrepareVote_about_block_in_view_global tr i b v') 
    intros msg0 H_in0.tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
H_vote: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (fst (tr i) n) v' b))
msg0: message
H_in0: In msg0
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) v' b)
In msg0
  (PrepareVote_about_block_in_view_global tr i b v')
    apply filter_In in H_in0.tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
H_vote: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (fst (tr i) n) v' b))
msg0: message
H_in0: In msg0 (counting_messages (fst (tr i) n)) /\
message_type_eqb (get_message_type msg0)
  PrepareVote && block_eqb (get_block msg0) b &&
(get_view msg0 =? v') = true
In msg0
  (PrepareVote_about_block_in_view_global tr i b v')
    destruct H_in0 as [H_in0 H_rest0].tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
H_vote: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (fst (tr i) n) v' b))
msg0: message
H_in0: In msg0 (counting_messages (fst (tr i) n))
H_rest0: message_type_eqb (get_message_type msg0)
  PrepareVote &&
block_eqb (get_block msg0) b &&
(get_view msg0 =? v') = true
In msg0
  (PrepareVote_about_block_in_view_global tr i b v')
    apply filter_In.tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
H_vote: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (fst (tr i) n) v' b))
msg0: message
H_in0: In msg0 (counting_messages (fst (tr i) n))
H_rest0: message_type_eqb (get_message_type msg0)
  PrepareVote &&
block_eqb (get_block msg0) b &&
(get_view msg0 =? v') = true
In msg0 (snd (tr i)) /\
message_type_eqb (get_message_type msg0) PrepareVote &&
block_eqb (get_block msg0) b && 
(get_view msg0 =? v') = true split.tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
H_vote: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (fst (tr i) n) v' b))
msg0: message
H_in0: In msg0 (counting_messages (fst (tr i) n))
H_rest0: message_type_eqb (get_message_type msg0)
  PrepareVote &&
block_eqb (get_block msg0) b &&
(get_view msg0 =? v') = true
In msg0 (snd (tr i))
tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
H_vote: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (fst (tr i) n) v' b))
msg0: message
H_in0: In msg0 (counting_messages (fst (tr i) n))
H_rest0: message_type_eqb (get_message_type msg0)
  PrepareVote &&
block_eqb (get_block msg0) b &&
(get_view msg0 =? v') = true
message_type_eqb (get_message_type msg0) PrepareVote &&
block_eqb (get_block msg0) b && 
(get_view msg0 =? v') = true
    apply processed_means_sent_global with n; try assumption.tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
H_vote: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (fst (tr i) n) v' b))
msg0: message
H_in0: In msg0 (counting_messages (fst (tr i) n))
H_rest0: message_type_eqb (get_message_type msg0)
  PrepareVote &&
block_eqb (get_block msg0) b &&
(get_view msg0 =? v') = true
message_type_eqb (get_message_type msg0) PrepareVote &&
block_eqb (get_block msg0) b && 
(get_view msg0 =? v') = true
    tauto. 
  -tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
H_qc: PrepareQC_in_view (fst (tr i) n) v' b
prepare_stage_in_view_global tr i b v' right.tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
H_qc: PrepareQC_in_view (fst (tr i) n) v' b
PrepareQC_in_view_global tr i b v'
    destruct H_qc as [msg [H_in H_rest]].tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
msg: message
H_in: In msg (counting_messages (fst (tr i) n))
H_rest: get_view msg = v' /\
get_block msg = b /\
get_message_type msg = PrepareQC
PrepareQC_in_view_global tr i b v'
    exists msg; split.tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
msg: message
H_in: In msg (counting_messages (fst (tr i) n))
H_rest: get_view msg = v' /\
get_block msg = b /\
get_message_type msg = PrepareQC
In msg (snd (tr i))
tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
msg: message
H_in: In msg (counting_messages (fst (tr i) n))
H_rest: get_view msg = v' /\
get_block msg = b /\
get_message_type msg = PrepareQC
get_view msg = v' /\
get_block msg = b /\ get_message_type msg = PrepareQC
    apply processed_means_sent_global with n; try assumption.tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
v': nat
H_past: v' <= node_view (fst (tr i) n)
msg: message
H_in: In msg (counting_messages (fst (tr i) n))
H_rest: get_view msg = v' /\
get_block msg = b /\
get_message_type msg = PrepareQC
get_view msg = v' /\
get_block msg = b /\ get_message_type msg = PrepareQC
    tauto.
Qed.

Precommit stage height injectivity statement

We are now ready to state the second safety property.

The second safety property states that no two same height blocks can be at precommit stage, i.e., precommit stage block height is injective. The second safety property does not require that the two blocks reach precommit stage in the same view.

More formally, in any global state i in a valid protocol trace tr that begins with the initial state and respects the protocol transition rules, if there are two participating nodes n and m, and two blocks b1 b2, such that b1 and b2 have the same height, and are both in precommit stage in n and m's local state respectively, but are not equal, then we can prove a contradiction.

Definition precommit_stage_height_injective_statement :=
  forall (tr : GTrace),
    protocol_trace tr ->
    forall (i : nat) (n m : node) (b1 b2 : block),
      In n participants ->
      In m participants ->
      b1 <> b2 -> 
      precommit_stage tr i n b1 ->
      precommit_stage tr i m b2 -> 
      b_height b1 = b_height b2 ->
      False.

In order to gain a better understanding of the case analysis required of this proof, we show the following fact:

Lemma precommit_stage_means_prepare_stage_global :
  forall tr i n b,
    protocol_trace tr ->
    In n participants -> 
    precommit_stage tr i n b ->
    exists b_child,
      parent_of b_child = b /\
      exists v v',
        prepare_stage_in_view_global tr i b v /\
        prepare_stage_in_view_global tr i b_child v'.forall (tr : GTrace) (i : nat) (n : node) (b : block),
protocol_trace tr ->
In n participants ->
precommit_stage tr i n b ->
exists b_child : block,
  parent_of b_child = b /\
  (exists v v' : nat,
     prepare_stage_in_view_global tr i b v /\
     prepare_stage_in_view_global tr i b_child v') 
Proof.forall (tr : GTrace) (i : nat) (n : node) (b : block),
protocol_trace tr ->
In n participants ->
precommit_stage tr i n b ->
exists b_child : block,
  parent_of b_child = b /\
  (exists v v' : nat,
     prepare_stage_in_view_global tr i b v /\
     prepare_stage_in_view_global tr i b_child v')
  intros tr i n b H_prot H_part H_precommit.tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
H_precommit: precommit_stage tr i n b
exists b_child : block,
  parent_of b_child = b /\
  (exists v v' : nat,
     prepare_stage_in_view_global tr i b v /\
     prepare_stage_in_view_global tr i b_child v')
  destruct H_precommit as [b_child [H_parent [H_prepare H_prepare_child]]].tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
b_child: block
H_parent: parent_of b_child = b
H_prepare: prepare_stage (fst (tr i) n) b
H_prepare_child: prepare_stage (fst (tr i) n) b_child
exists b_child : block,
  parent_of b_child = b /\
  (exists v v' : nat,
     prepare_stage_in_view_global tr i b v /\
     prepare_stage_in_view_global tr i b_child v')
  exists b_child.tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
b_child: block
H_parent: parent_of b_child = b
H_prepare: prepare_stage (fst (tr i) n) b
H_prepare_child: prepare_stage (fst (tr i) n) b_child
parent_of b_child = b /\
(exists v v' : nat,
   prepare_stage_in_view_global tr i b v /\
   prepare_stage_in_view_global tr i b_child v') split.tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
b_child: block
H_parent: parent_of b_child = b
H_prepare: prepare_stage (fst (tr i) n) b
H_prepare_child: prepare_stage (fst (tr i) n) b_child
parent_of b_child = b
tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
b_child: block
H_parent: parent_of b_child = b
H_prepare: prepare_stage (fst (tr i) n) b
H_prepare_child: prepare_stage (fst (tr i) n) b_child
exists v v' : nat,
  prepare_stage_in_view_global tr i b v /\
  prepare_stage_in_view_global tr i b_child v' assumption.tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
b_child: block
H_parent: parent_of b_child = b
H_prepare: prepare_stage (fst (tr i) n) b
H_prepare_child: prepare_stage (fst (tr i) n) b_child
exists v v' : nat,
  prepare_stage_in_view_global tr i b v /\
  prepare_stage_in_view_global tr i b_child v'
  destruct H_prepare as [v [H_past H_prepare]].tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
b_child: block
H_parent: parent_of b_child = b
v: nat
H_past: v <= node_view (fst (tr i) n)
H_prepare: prepare_stage_in_view (fst (tr i) n) v b
H_prepare_child: prepare_stage (fst (tr i) n) b_child
exists v v' : nat,
  prepare_stage_in_view_global tr i b v /\
  prepare_stage_in_view_global tr i b_child v'
  destruct H_prepare_child as [v' [H_past_child H_prepare_child]].tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
b_child: block
H_parent: parent_of b_child = b
v: nat
H_past: v <= node_view (fst (tr i) n)
H_prepare: prepare_stage_in_view (fst (tr i) n) v b
v': nat
H_past_child: v' <= node_view (fst (tr i) n)
H_prepare_child: prepare_stage_in_view (fst (tr i) n)
  v' b_child
exists v v' : nat,
  prepare_stage_in_view_global tr i b v /\
  prepare_stage_in_view_global tr i b_child v'
  exists v, v'.tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
b_child: block
H_parent: parent_of b_child = b
v: nat
H_past: v <= node_view (fst (tr i) n)
H_prepare: prepare_stage_in_view (fst (tr i) n) v b
v': nat
H_past_child: v' <= node_view (fst (tr i) n)
H_prepare_child: prepare_stage_in_view (fst (tr i) n)
  v' b_child
prepare_stage_in_view_global tr i b v /\
prepare_stage_in_view_global tr i b_child v' split.tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
b_child: block
H_parent: parent_of b_child = b
v: nat
H_past: v <= node_view (fst (tr i) n)
H_prepare: prepare_stage_in_view (fst (tr i) n) v b
v': nat
H_past_child: v' <= node_view (fst (tr i) n)
H_prepare_child: prepare_stage_in_view (fst (tr i) n)
  v' b_child
prepare_stage_in_view_global tr i b v
tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
b_child: block
H_parent: parent_of b_child = b
v: nat
H_past: v <= node_view (fst (tr i) n)
H_prepare: prepare_stage_in_view (fst (tr i) n) v b
v': nat
H_past_child: v' <= node_view (fst (tr i) n)
H_prepare_child: prepare_stage_in_view (fst (tr i) n)
  v' b_child
prepare_stage_in_view_global tr i b_child v'
  now apply prepare_stage_in_view_means_prepare_stage_in_view_global with n.tr: GTrace
i: nat
n: node
b: block
H_prot: protocol_trace tr
H_part: In n participants
b_child: block
H_parent: parent_of b_child = b
v: nat
H_past: v <= node_view (fst (tr i) n)
H_prepare: prepare_stage_in_view (fst (tr i) n) v b
v': nat
H_past_child: v' <= node_view (fst (tr i) n)
H_prepare_child: prepare_stage_in_view (fst (tr i) n)
  v' b_child
prepare_stage_in_view_global tr i b_child v'
  now apply prepare_stage_in_view_means_prepare_stage_in_view_global with n.
Qed.

From the lemma above, we know that we have at least four views: let v1, v1' be the views during which b1 and b1's child reach global prepare stage, and let v2, v2' be the views during which b2 and b2's child reach global prepare stage. The first layer of case analysis proceeds on v1 and v2:

In the case that v1 = v2, we have already proven this in the process of proving prepare_stage_same_view_height_injective_statement.
In the case that v1 <> v2, we have two symmetric cases. Without loss of generality, suppose v1 < v2. Globally, a child block must reach prepare stage after its parent block, i.e. v1 <= v1'. By further case analysis on v1' and v2':
- In the case that v1 = v1', either
  - v2 = v2', or
  - v2 < v2'.
- In the case that v1 < v1', either
  - v1 < v2 <= v2' < v1', or
  - v1 < v1' < v2 <= v2', or
  - v1 < v2 < v1' < v2'.

It comes as no surprise that some of these cases are vacuous according to the protocol. It should also be evidence that the complexity of this second safety proof towers over that of the first safety proof, by virtue of the number of cases we must analyze based on four views.

We break down this proof into more manageable chunks by first considering the special case in which the block and its child reach prepare stage in the same view that is also the current view.

Definition precommit_stage_now (tr : GTrace) (i : nat) (n : node) (b : block) :=
  exists b_child,
    parent_of b_child = b /\
    prepare_stage_in_view (fst (tr i) n) (node_view (fst (tr i) n)) b /\
    prepare_stage_in_view (fst (tr i) n) (node_view (fst (tr i) n)) b_child.

We can reorganize our cases into those for which v1 = v1' and v2= v2' and v1 < v2, and those for which this is not the case. The statement of the safety property for the former cases is as follows, whereby v1 = v (fst (tr i) n) and v2 = v (fst (tr i) m):

Definition precommit_stage_now_height_injective_statement :=
  forall (tr : GTrace),
    protocol_trace tr ->
    forall (i : nat) (n m : node) (b1 b2 : block),
      In n participants ->
      In m participants ->
      node_view (fst (tr i) n) < node_view (fst (tr i) m) -> 
      b1 <> b2 -> 
      precommit_stage_now tr i n b1 ->
      precommit_stage_now tr i m b2 -> 
      b_height b1 = b_height b2 ->
      False.

Reducing the proof

We first provide intuition on the key properties of Giskard that this statement relies on. In order to do so, we first require the following definitions of maximum and minimum height prepare stage blocks in a given view:

Instead of defining "the highest block to reach prepare stage globally in any view for any node" computationally, we define it propositionally and then prove its existence:

Definition is_max_prepare_height_global (tr : GTrace) (i : nat) (h : nat) :=
  (exists b p, prepare_stage_in_view_global tr i b p /\ b_height b = h) /\ 
  (forall b p, prepare_stage_in_view_global tr i b p -> b_height b <= h).

Definition is_max_prepare_height_in_view_global (tr : GTrace) (i : nat) (h : nat) (p : nat) :=
  (exists b, prepare_stage_in_view_global tr i b p /\ b_height b = h) /\ 
  (forall b, prepare_stage_in_view_global tr i b p -> b_height b <= h).

Definition is_max_prepare_height_in_view (tr : GTrace) (i : nat) (n : node) (h : nat) (p : nat) :=
  In n participants /\ 
  node_view (fst (tr i) n) = p /\
  (exists b, prepare_stage_in_view (fst (tr i) n) p b /\ b_height b = h) /\
  (forall b', prepare_stage_in_view (fst (tr i) n) p b' -> b_height b' <= h).

Definition exists_max_prepare_height_in_view_global :=
  forall tr i p, protocol_trace tr ->
    (exists b, prepare_stage_in_view_global tr i b p) ->
    exists h, is_max_prepare_height_in_view_global tr i h p.
  
Lemma local_leq_global :
  forall tr i h p,
    protocol_trace tr -> 
    is_max_prepare_height_in_view_global tr i h p ->
    forall n h_local,
      is_max_prepare_height_in_view tr i n h_local p ->
      h_local <= h.forall (tr : GTrace) (i h p : nat),
protocol_trace tr ->
is_max_prepare_height_in_view_global tr i h p ->
forall (n : node) (h_local : nat),
is_max_prepare_height_in_view tr i n h_local p ->
h_local <= h 
Proof.forall (tr : GTrace) (i h p : nat),
protocol_trace tr ->
is_max_prepare_height_in_view_global tr i h p ->
forall (n : node) (h_local : nat),
is_max_prepare_height_in_view tr i n h_local p ->
h_local <= h 
  intros tr i h p H_prot H_global n h_local H_local.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_global: is_max_prepare_height_in_view_global tr i h
  p
n: node
h_local: nat
H_local: is_max_prepare_height_in_view tr i n h_local
  p
h_local <= h
  destruct (le_dec h_local h) as [H_goal | H_false].tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_global: is_max_prepare_height_in_view_global tr i h
  p
n: node
h_local: nat
H_local: is_max_prepare_height_in_view tr i n h_local
  p
H_goal: h_local <= h
h_local <= h
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_global: is_max_prepare_height_in_view_global tr i h
  p
n: node
h_local: nat
H_local: is_max_prepare_height_in_view tr i n h_local
  p
H_false: ~ h_local <= h
h_local <= h
  -tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_global: is_max_prepare_height_in_view_global tr i h
  p
n: node
h_local: nat
H_local: is_max_prepare_height_in_view tr i n h_local
  p
H_goal: h_local <= h
h_local <= h assumption.
  - (* Now we prove a contradiction *)tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_global: is_max_prepare_height_in_view_global tr i h
  p
n: node
h_local: nat
H_local: is_max_prepare_height_in_view tr i n h_local
  p
H_false: ~ h_local <= h
h_local <= h
    exfalso.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_global: is_max_prepare_height_in_view_global tr i h
  p
n: node
h_local: nat
H_local: is_max_prepare_height_in_view tr i n h_local
  p
H_false: ~ h_local <= h
False
    assert (h_local > h) by lia.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_global: is_max_prepare_height_in_view_global tr i h
  p
n: node
h_local: nat
H_local: is_max_prepare_height_in_view tr i n h_local
  p
H_false: ~ h_local <= h
H: h_local > h
False
    clear H_false.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_global: is_max_prepare_height_in_view_global tr i h
  p
n: node
h_local: nat
H_local: is_max_prepare_height_in_view tr i n h_local
  p
H: h_local > h
False
    destruct H_global as [H_gprepare H_ghighest].tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
H_ghighest: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h
n: node
h_local: nat
H_local: is_max_prepare_height_in_view tr i n h_local
  p
H: h_local > h
False
    destruct H_local as [H_part [H_lview [H_lprepare H_lhighest]]].tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
H_ghighest: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
H_lprepare: exists b : block,
  prepare_stage_in_view 
    (fst (tr i) n) p b /\
  b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
False
    destruct H_lprepare as [b [H_lprepare H_lheight]].tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
H_ghighest: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
False
    spec H_ghighest b.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
False spec H_ghighest.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
prepare_stage_in_view_global tr i b p
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: b_height b <= h
False
    destruct H_lprepare as [H_left | H_right].tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_left: vote_quorum_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
prepare_stage_in_view_global tr i b p
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_right: PrepareQC_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
prepare_stage_in_view_global tr i b p
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: b_height b <= h
False
    left.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_left: vote_quorum_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
vote_quorum_in_view_global tr i b p
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_right: PrepareQC_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
prepare_stage_in_view_global tr i b p
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: b_height b <= h
False red.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_left: vote_quorum_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
quorum
  (PrepareVote_about_block_in_view_global tr i b p)
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_right: PrepareQC_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
prepare_stage_in_view_global tr i b p
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: b_height b <= h
False red in H_left.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_left: quorum
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b)
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
quorum
  (PrepareVote_about_block_in_view_global tr i b p)
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_right: PrepareQC_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
prepare_stage_in_view_global tr i b p
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: b_height b <= h
False
    apply quorum_subset with
      (processed_PrepareVote_in_view_about_block (fst (tr i) n) p b).tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_left: quorum
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b)
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
quorum
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b)
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_left: quorum
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b)
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
forall msg : message,
In msg
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b) ->
In msg
  (PrepareVote_about_block_in_view_global tr i b p)
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_right: PrepareQC_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
prepare_stage_in_view_global tr i b p
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: b_height b <= h
False
    assumption.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_left: quorum
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b)
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
forall msg : message,
In msg
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b) ->
In msg
  (PrepareVote_about_block_in_view_global tr i b p)
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_right: PrepareQC_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
prepare_stage_in_view_global tr i b p
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: b_height b <= h
False intros msg H_in.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_left: quorum
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b)
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
msg: message
H_in: In msg
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b)
In msg
  (PrepareVote_about_block_in_view_global tr i b p)
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_right: PrepareQC_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
prepare_stage_in_view_global tr i b p
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: b_height b <= h
False
    apply filter_In in H_in.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_left: quorum
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b)
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
msg: message
H_in: In msg (counting_messages (fst (tr i) n)) /\
message_type_eqb (get_message_type msg)
  PrepareVote && block_eqb (get_block msg) b &&
(get_view msg =? p) = true
In msg
  (PrepareVote_about_block_in_view_global tr i b p)
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_right: PrepareQC_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
prepare_stage_in_view_global tr i b p
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: b_height b <= h
False
    destruct H_in as [H_in H_typeblock].tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_left: quorum
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b)
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
msg: message
H_in: In msg (counting_messages (fst (tr i) n))
H_typeblock: message_type_eqb (get_message_type msg)
  PrepareVote &&
block_eqb (get_block msg) b &&
(get_view msg =? p) = true
In msg
  (PrepareVote_about_block_in_view_global tr i b p)
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_right: PrepareQC_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
prepare_stage_in_view_global tr i b p
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: b_height b <= h
False
    apply andb_prop in H_typeblock.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_left: quorum
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b)
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
msg: message
H_in: In msg (counting_messages (fst (tr i) n))
H_typeblock: message_type_eqb (get_message_type msg)
  PrepareVote &&
block_eqb (get_block msg) b = true /\
(get_view msg =? p) = true
In msg
  (PrepareVote_about_block_in_view_global tr i b p)
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_right: PrepareQC_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
prepare_stage_in_view_global tr i b p
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: b_height b <= h
False
    destruct H_typeblock as [H_typeblock H_view].tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_left: quorum
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b)
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
msg: message
H_in: In msg (counting_messages (fst (tr i) n))
H_typeblock: message_type_eqb (get_message_type msg)
  PrepareVote &&
block_eqb (get_block msg) b = true
H_view: (get_view msg =? p) = true
In msg
  (PrepareVote_about_block_in_view_global tr i b p)
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_right: PrepareQC_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
prepare_stage_in_view_global tr i b p
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: b_height b <= h
False
    apply andb_prop in H_typeblock.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_left: quorum
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b)
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
msg: message
H_in: In msg (counting_messages (fst (tr i) n))
H_typeblock: message_type_eqb (get_message_type msg)
  PrepareVote = true /\
block_eqb (get_block msg) b = true
H_view: (get_view msg =? p) = true
In msg
  (PrepareVote_about_block_in_view_global tr i b p)
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_right: PrepareQC_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
prepare_stage_in_view_global tr i b p
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: b_height b <= h
False
    destruct H_typeblock as [H_type H_block].tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_left: quorum
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b)
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
msg: message
H_in: In msg (counting_messages (fst (tr i) n))
H_type: message_type_eqb (get_message_type msg)
  PrepareVote = true
H_block: block_eqb (get_block msg) b = true
H_view: (get_view msg =? p) = true
In msg
  (PrepareVote_about_block_in_view_global tr i b p)
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_right: PrepareQC_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
prepare_stage_in_view_global tr i b p
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: b_height b <= h
False
    apply filter_In.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_left: quorum
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b)
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
msg: message
H_in: In msg (counting_messages (fst (tr i) n))
H_type: message_type_eqb (get_message_type msg)
  PrepareVote = true
H_block: block_eqb (get_block msg) b = true
H_view: (get_view msg =? p) = true
In msg (snd (tr i)) /\
message_type_eqb (get_message_type msg) PrepareVote &&
block_eqb (get_block msg) b && 
(get_view msg =? p) = true
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_right: PrepareQC_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
prepare_stage_in_view_global tr i b p
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: b_height b <= h
False 
    split.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_left: quorum
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b)
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
msg: message
H_in: In msg (counting_messages (fst (tr i) n))
H_type: message_type_eqb (get_message_type msg)
  PrepareVote = true
H_block: block_eqb (get_block msg) b = true
H_view: (get_view msg =? p) = true
In msg (snd (tr i))
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_left: quorum
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b)
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
msg: message
H_in: In msg (counting_messages (fst (tr i) n))
H_type: message_type_eqb (get_message_type msg)
  PrepareVote = true
H_block: block_eqb (get_block msg) b = true
H_view: (get_view msg =? p) = true
message_type_eqb (get_message_type msg) PrepareVote &&
block_eqb (get_block msg) b && 
(get_view msg =? p) = true
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_right: PrepareQC_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
prepare_stage_in_view_global tr i b p
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: b_height b <= h
False
    now apply processed_means_sent_global with n.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_left: quorum
  (processed_PrepareVote_in_view_about_block
     (fst (tr i) n) p b)
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
msg: message
H_in: In msg (counting_messages (fst (tr i) n))
H_type: message_type_eqb (get_message_type msg)
  PrepareVote = true
H_block: block_eqb (get_block msg) b = true
H_view: (get_view msg =? p) = true
message_type_eqb (get_message_type msg) PrepareVote &&
block_eqb (get_block msg) b && 
(get_view msg =? p) = true
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_right: PrepareQC_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
prepare_stage_in_view_global tr i b p
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: b_height b <= h
False 
    repeat (apply andb_true_iff; split); assumption.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_right: PrepareQC_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
prepare_stage_in_view_global tr i b p
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: b_height b <= h
False 
    right.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_right: PrepareQC_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
PrepareQC_in_view_global tr i b p
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: b_height b <= h
False
    destruct H_right as [msg [H_in [H_view [H_block H_type]]]].tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
msg: message
H_in: In msg (counting_messages (fst (tr i) n))
H_view: get_view msg = p
H_block: get_block msg = b
H_type: get_message_type msg = PrepareQC
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
PrepareQC_in_view_global tr i b p
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: b_height b <= h
False
    exists msg; repeat split; try assumption.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
msg: message
H_in: In msg (counting_messages (fst (tr i) n))
H_view: get_view msg = p
H_block: get_block msg = b
H_type: get_message_type msg = PrepareQC
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: prepare_stage_in_view_global tr i b p ->
b_height b <= h
In msg (snd (tr i))
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: b_height b <= h
False 
    now apply processed_means_sent_global with n.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H_lhighest: forall b' : block,
prepare_stage_in_view (fst (tr i) n) p b' ->
b_height b' <= h_local
H: h_local > h
H_ghighest: b_height b <= h
False
    spec H_lhighest b H_lprepare.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_gprepare: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
n: node
h_local: nat
H_part: In n participants
H_lview: node_view (fst (tr i) n) = p
b: block
H_lprepare: prepare_stage_in_view (fst (tr i) n) p b
H_lheight: b_height b = h_local
H: h_local > h
H_ghighest: b_height b <= h
H_lhighest: b_height b <= h_local
False 
    lia.
Qed.

Definition is_min_prepare_height_global (tr : GTrace) (i : nat) (h : nat) :=
  (exists b p, prepare_stage_in_view_global tr i b p /\ b_height b = h) /\ 
  (forall b p, prepare_stage_in_view_global tr i b p -> b_height b >= h).

Definition is_min_prepare_height_in_view_global (tr : GTrace) (i : nat) (h : nat) (p : nat) :=
  (exists b, prepare_stage_in_view_global tr i b p /\ b_height b = h) /\ 
  (forall b, prepare_stage_in_view_global tr i b p -> b_height b >= h).

Definition is_min_prepare_height_in_view (tr : GTrace) (i : nat) (n : node) (h : nat) (p : nat) :=
  In n participants /\ 
  node_view (fst (tr i) n) = p /\
  (exists b, prepare_stage_in_view (fst (tr i) n) p b /\ b_height b = h) /\
  (forall b', prepare_stage_in_view (fst (tr i) n) p b' -> b_height b' >= h).

The first key property states that for every lowest prepare stage block in a view, its parent block must be either the highest or second-highest prepare stage block of a past view. Intuitively, this is because there are three cases of view change:

normal view change, last and highest block reaches prepare stage, and
abnormal view change, highest prepare block is contained in ViewChangeQC message, and
abnormal view change, second highest prepare block is contained in ViewChangeQC message.

Definition prepare_stage_first_parent_highest_or_second_global :=
  forall tr i, protocol_trace tr ->
    forall b1 v1, is_min_prepare_height_in_view_global tr i (b_height b1) v1 ->
     exists v', v' <= v1 /\
      (is_max_prepare_height_in_view_global tr i (b_height (parent_of b1)) v' \/
       is_max_prepare_height_in_view_global tr i (b_height (parent_of b1) + 1) v').

The second key property states that prepare stage block height increases as view increments. Intuitively, this is because new blocks are proposed on top of a block carried over from the previous round, either through normal or abnormal view change.

Definition prepare_stage_height_view_morphism_global :=
  forall tr i, protocol_trace tr ->
    forall b1 b2 v1 v2,
      prepare_stage_in_view_global tr i b1 v1 ->
      prepare_stage_in_view_global tr i b2 v2 ->
      v1 <= v2 ->
      b_height b1 <= b_height b2.

The third key property specializes the lemma above and states that non-last prepare stage block height strictly increases as view increments.

Definition prepare_stage_height_view_morphism_global_non_last :=
  forall tr i, protocol_trace tr ->
    forall b1 b2 v1 v2,
      prepare_stage_in_view_global tr i b1 v1 ->
      prepare_stage_in_view_global tr i b2 v2 ->
      ~ last_block b1 -> 
      v1 <= v2 ->
      b_height b1 < b_height b2.

Finally, a block that has a child block in prepare stage in the same view cannot be the last block of the view. Intuitively, this is true by construction.

Definition prepare_stage_child_non_last :=
  forall tr i n v b, protocol_trace tr ->
    In n participants -> 
    prepare_stage_in_view (fst (tr i) n) v b ->
    (exists b_child,
      parent_of b_child = b /\
      prepare_stage_in_view (fst (tr i) n) v b_child) ->
    ~ last_block b.

We now show how we can use the four key properties above to prove our desired safety result:

Lemma precommit_height_injective_symmetric :
  prepare_stage_first_parent_highest_or_second_global -> 
  prepare_stage_height_view_morphism_global -> 
  prepare_stage_height_view_morphism_global_non_last ->
  prepare_stage_child_non_last -> 
  forall (tr : GTrace),
    protocol_trace tr ->
    forall (i : nat) (n m : node),
      In n participants ->
      In m participants ->
      forall (b1 b2 : block),
        b1 <> b2 -> 
        precommit_stage_now tr i n b1 ->
        precommit_stage_now tr i m b2 -> 
        b_height b1 = b_height b2 ->
        False.prepare_stage_first_parent_highest_or_second_global ->
prepare_stage_height_view_morphism_global ->
prepare_stage_height_view_morphism_global_non_last ->
prepare_stage_child_non_last ->
forall tr : GTrace,
protocol_trace tr ->
forall (i : nat) (n m : node),
In n participants ->
In m participants ->
forall b1 b2 : block,
b1 <> b2 ->
precommit_stage_now tr i n b1 ->
precommit_stage_now tr i m b2 ->
b_height b1 = b_height b2 -> False
Proof.prepare_stage_first_parent_highest_or_second_global ->
prepare_stage_height_view_morphism_global ->
prepare_stage_height_view_morphism_global_non_last ->
prepare_stage_child_non_last ->
forall tr : GTrace,
protocol_trace tr ->
forall (i : nat) (n m : node),
In n participants ->
In m participants ->
forall b1 b2 : block,
b1 <> b2 ->
precommit_stage_now tr i n b1 ->
precommit_stage_now tr i m b2 ->
b_height b1 = b_height b2 -> False                          
  intros H_useful1 H_useful2 H_useful3 H_useful4 tr H_prot i n m.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
In n participants ->
In m participants ->
forall b1 b2 : block,
b1 <> b2 ->
precommit_stage_now tr i n b1 ->
precommit_stage_now tr i m b2 ->
b_height b1 = b_height b2 -> False
  intros H_part_n H_part_m b1 b2 H_neq H_precommit1 H_precommit2 H_height.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
False
  destruct H_precommit1 as [b_child1 [H_height1 [H_prepare1 H_prepare_child1]]].H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n)
  (node_view (fst (tr i) n)) b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n)
  (node_view (fst (tr i) n))
  b_child1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
False 
  destruct H_precommit2 as [b_child2 [H_height2 [H_prepare2 H_prepare_child2]]].H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n)
  (node_view (fst (tr i) n)) b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n)
  (node_view (fst (tr i) n))
  b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m)
  (node_view (fst (tr i) m)) b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m)
  (node_view (fst (tr i) m))
  b_child2
H_height: b_height b1 = b_height b2
False

  remember (node_view (fst (tr i) n)) as v1;
    remember (node_view (fst (tr i) m)) as v2.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
False 
  assert (v1 < v2 \/ v1 = v2 \/ v2 < v1) by lia.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H: v1 < v2 \/ v1 = v2 \/ v2 < v1
False 
  destruct H as [H_lt | [H_eq | H_gt]].H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_lt: v1 < v2
False
H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_eq: v1 = v2
False
H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_gt: v2 < v1
False

  -H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_lt: v1 < v2
False assert (~ last_block b1).H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_lt: v1 < v2
~ last_block b1
H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_lt: v1 < v2
H: ~ last_block b1
False
    {H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_lt: v1 < v2
~ last_block b1 spec H_useful4 tr i n v1 b1 H_prot H_part_n.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_lt: v1 < v2
H_useful4: prepare_stage_in_view (fst (tr i) n) v1 b1 ->
(exists b_child : block,
   parent_of b_child = b1 /\
   prepare_stage_in_view 
     (fst (tr i) n) v1 b_child) ->
~ last_block b1
~ last_block b1
      spec H_useful4 H_prepare1.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_lt: v1 < v2
H_useful4: (exists b_child : block,
   parent_of b_child = b1 /\
   prepare_stage_in_view 
     (fst (tr i) n) v1 b_child) ->
~ last_block b1
~ last_block b1
      spec H_useful4.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_lt: v1 < v2
H_useful4: (exists b_child : block,
   parent_of b_child = b1 /\
   prepare_stage_in_view 
     (fst (tr i) n) v1 b_child) ->
~ last_block b1
exists b_child : block,
  parent_of b_child = b1 /\
  prepare_stage_in_view (fst (tr i) n) v1 b_child
H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_lt: v1 < v2
H_useful4: ~ last_block b1
~ last_block b1 exists b_child1; repeat split; tauto.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_lt: v1 < v2
H_useful4: ~ last_block b1
~ last_block b1 assumption. }H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_lt: v1 < v2
H: ~ last_block b1
False 
    apply prepare_stage_in_view_means_prepare_stage_in_view_global in H_prepare1; try assumption.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view_global tr i b1 v1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_lt: v1 < v2
H: ~ last_block b1
False 
    apply prepare_stage_in_view_means_prepare_stage_in_view_global in H_prepare2; try assumption.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view_global tr i b1 v1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view_global tr i b2 v2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_lt: v1 < v2
H: ~ last_block b1
False 
    spec H_useful3 tr i H_prot b1 b2 v1 v2.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view_global tr i b1 v1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view_global tr i b2 v2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_lt: v1 < v2
H: ~ last_block b1
H_useful3: prepare_stage_in_view_global tr i b1 v1 ->
prepare_stage_in_view_global tr i b2 v2 ->
~ last_block b1 ->
v1 <= v2 -> b_height b1 < b_height b2
False
    spec H_useful3 H_prepare1 H_prepare2 H.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view_global tr i b1 v1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view_global tr i b2 v2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_lt: v1 < v2
H: ~ last_block b1
H_useful3: v1 <= v2 -> b_height b1 < b_height b2
False 
    spec H_useful3.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view_global tr i b1 v1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view_global tr i b2 v2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_lt: v1 < v2
H: ~ last_block b1
H_useful3: v1 <= v2 -> b_height b1 < b_height b2
v1 <= v2
H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view_global tr i b1 v1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view_global tr i b2 v2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_lt: v1 < v2
H: ~ last_block b1
H_useful3: b_height b1 < b_height b2
False lia.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view_global tr i b1 v1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view_global tr i b2 v2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_lt: v1 < v2
H: ~ last_block b1
H_useful3: b_height b1 < b_height b2
False
    lia.
  -H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_eq: v1 = v2
False subst.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b_child1, b_child2: block
H_neq: parent_of b_child1 <> parent_of b_child2
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n)
  (node_view (fst (tr i) n))
  b_child1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n)
  (node_view (fst (tr i) n))
  (parent_of b_child1)
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m)
  (node_view (fst (tr i) m))
  b_child2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m)
  (node_view (fst (tr i) m))
  (parent_of b_child2)
H_height: b_height (parent_of b_child1) =
b_height (parent_of b_child2)
H_eq: node_view (fst (tr i) n) =
node_view (fst (tr i) m)
False
    apply prepare_stage_same_view_height_injective with
     tr i n m (parent_of b_child1) (parent_of b_child2) (node_view (fst (tr i) m)); try assumption.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b_child1, b_child2: block
H_neq: parent_of b_child1 <> parent_of b_child2
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n)
  (node_view (fst (tr i) n))
  b_child1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n)
  (node_view (fst (tr i) n))
  (parent_of b_child1)
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m)
  (node_view (fst (tr i) m))
  b_child2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m)
  (node_view (fst (tr i) m))
  (parent_of b_child2)
H_height: b_height (parent_of b_child1) =
b_height (parent_of b_child2)
H_eq: node_view (fst (tr i) n) =
node_view (fst (tr i) m)
prepare_stage_in_view 
  (fst (tr i) n) (node_view (fst (tr i) m))
  (parent_of b_child1)
    rewrite H_eq in H_prepare1.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b_child1, b_child2: block
H_neq: parent_of b_child1 <> parent_of b_child2
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n)
  (node_view (fst (tr i) n))
  b_child1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n)
  (node_view (fst (tr i) m))
  (parent_of b_child1)
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m)
  (node_view (fst (tr i) m))
  b_child2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m)
  (node_view (fst (tr i) m))
  (parent_of b_child2)
H_height: b_height (parent_of b_child1) =
b_height (parent_of b_child2)
H_eq: node_view (fst (tr i) n) =
node_view (fst (tr i) m)
prepare_stage_in_view 
  (fst (tr i) n) (node_view (fst (tr i) m))
  (parent_of b_child1)  assumption.
  -H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_gt: v2 < v1
False assert (~ last_block b2).H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_gt: v2 < v1
~ last_block b2
H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_gt: v2 < v1
H: ~ last_block b2
False
    {H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_gt: v2 < v1
~ last_block b2 spec H_useful4 tr i m v2 b2 H_prot H_part_m.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_gt: v2 < v1
H_useful4: prepare_stage_in_view (fst (tr i) m) v2 b2 ->
(exists b_child : block,
   parent_of b_child = b2 /\
   prepare_stage_in_view 
     (fst (tr i) m) v2 b_child) ->
~ last_block b2
~ last_block b2
      spec H_useful4 H_prepare2.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_gt: v2 < v1
H_useful4: (exists b_child : block,
   parent_of b_child = b2 /\
   prepare_stage_in_view 
     (fst (tr i) m) v2 b_child) ->
~ last_block b2
~ last_block b2
      spec H_useful4.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_gt: v2 < v1
H_useful4: (exists b_child : block,
   parent_of b_child = b2 /\
   prepare_stage_in_view 
     (fst (tr i) m) v2 b_child) ->
~ last_block b2
exists b_child : block,
  parent_of b_child = b2 /\
  prepare_stage_in_view (fst (tr i) m) v2 b_child
H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_gt: v2 < v1
H_useful4: ~ last_block b2
~ last_block b2 exists b_child2; repeat split; tauto.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_gt: v2 < v1
H_useful4: ~ last_block b2
~ last_block b2 assumption. }H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_gt: v2 < v1
H: ~ last_block b2
False  
    apply prepare_stage_in_view_means_prepare_stage_in_view_global in H_prepare1; try assumption.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view_global tr i b1 v1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_gt: v2 < v1
H: ~ last_block b2
False 
    apply prepare_stage_in_view_means_prepare_stage_in_view_global in H_prepare2; try assumption.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful3: prepare_stage_height_view_morphism_global_non_last
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view_global tr i b1 v1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view_global tr i b2 v2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_gt: v2 < v1
H: ~ last_block b2
False 
    spec H_useful3 tr i H_prot b2 b1 v2 v1.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view_global tr i b1 v1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view_global tr i b2 v2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_gt: v2 < v1
H: ~ last_block b2
H_useful3: prepare_stage_in_view_global tr i b2 v2 ->
prepare_stage_in_view_global tr i b1 v1 ->
~ last_block b2 ->
v2 <= v1 -> b_height b2 < b_height b1
False
    spec H_useful3 H_prepare2 H_prepare1 H.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view_global tr i b1 v1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view_global tr i b2 v2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_gt: v2 < v1
H: ~ last_block b2
H_useful3: v2 <= v1 -> b_height b2 < b_height b1
False 
    spec H_useful3.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view_global tr i b1 v1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view_global tr i b2 v2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_gt: v2 < v1
H: ~ last_block b2
H_useful3: v2 <= v1 -> b_height b2 < b_height b1
v2 <= v1
H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view_global tr i b1 v1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view_global tr i b2 v2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_gt: v2 < v1
H: ~ last_block b2
H_useful3: b_height b2 < b_height b1
False lia.H_useful1: prepare_stage_first_parent_highest_or_second_global
H_useful2: prepare_stage_height_view_morphism_global
H_useful4: prepare_stage_child_non_last
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
H_prepare1: prepare_stage_in_view_global tr i b1 v1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_prepare2: prepare_stage_in_view_global tr i b2 v2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_gt: v2 < v1
H: ~ last_block b2
H_useful3: b_height b2 < b_height b1
False
    lia.
Qed.

Now that we have walked through one possible and relatively intuitive proof by identifying and assuming certain key lemmas, we proceed to break down the proof piecewise. We start by proving facts about view changes - a feature that is absent from the first safety proof, which only deals with behaviors within the same view.

Based on Giskard's view change process, we know that a view change is triggered either normally or abnormally. In the normal case, the last block of the previous view must have reached prepare stage, as evidenced by the existence of a PrepareQC message for it in the global message buffer.

Definition normal_trigger_message_global (tr : GTrace) (i : nat) (p : nat) (msg : message) :=
  (* In the normal view change case *) 
  (get_message_type msg = PrepareQC /\
   get_view msg = p /\
   b_last (get_block msg) = true /\
   In msg (snd (tr i))).

In the abnormal case, there must be a ViewChangeQC message in the global message buffer.

Definition timeout_trigger_message_global (tr : GTrace) (i : nat) (p : nat) (msg : message) :=
  (* In the timeout view change case *)
  (get_message_type msg = ViewChangeQC /\
   get_view msg = p /\
   In msg (snd (tr i))).

Definition timeout_trigger_message_global_dec : forall (tr : GTrace) (i : nat) (p : nat) (msg : message),
  { timeout_trigger_message_global tr i p msg} + { ~ timeout_trigger_message_global tr i p msg }.forall (tr : GTrace) (i p : nat) (msg : message),
{timeout_trigger_message_global tr i p msg} +
{~ timeout_trigger_message_global tr i p msg}
Proof.forall (tr : GTrace) (i p : nat) (msg : message),
{timeout_trigger_message_global tr i p msg} +
{~ timeout_trigger_message_global tr i p msg}
intros.tr: GTrace
i, p: nat
msg: message
{timeout_trigger_message_global tr i p msg} +
{~ timeout_trigger_message_global tr i p msg}
case (message_type_eq_dec (get_message_type msg) ViewChangeQC); intros.tr: GTrace
i, p: nat
msg: message
e: get_message_type msg = ViewChangeQC
{timeout_trigger_message_global tr i p msg} +
{~ timeout_trigger_message_global tr i p msg}
tr: GTrace
i, p: nat
msg: message
n: get_message_type msg <> ViewChangeQC
{timeout_trigger_message_global tr i p msg} +
{~ timeout_trigger_message_global tr i p msg}
-tr: GTrace
i, p: nat
msg: message
e: get_message_type msg = ViewChangeQC
{timeout_trigger_message_global tr i p msg} +
{~ timeout_trigger_message_global tr i p msg} case (Nat.eq_dec (get_view msg) p); intros.tr: GTrace
i, p: nat
msg: message
e: get_message_type msg = ViewChangeQC
e0: get_view msg = p
{timeout_trigger_message_global tr i p msg} +
{~ timeout_trigger_message_global tr i p msg}
tr: GTrace
i, p: nat
msg: message
e: get_message_type msg = ViewChangeQC
n: get_view msg <> p
{timeout_trigger_message_global tr i p msg} +
{~ timeout_trigger_message_global tr i p msg}
  *tr: GTrace
i, p: nat
msg: message
e: get_message_type msg = ViewChangeQC
e0: get_view msg = p
{timeout_trigger_message_global tr i p msg} +
{~ timeout_trigger_message_global tr i p msg} case (In_dec message_eq_dec msg (snd (tr i))); intros.tr: GTrace
i, p: nat
msg: message
e: get_message_type msg = ViewChangeQC
e0: get_view msg = p
i0: In msg (snd (tr i))
{timeout_trigger_message_global tr i p msg} +
{~ timeout_trigger_message_global tr i p msg}
tr: GTrace
i, p: nat
msg: message
e: get_message_type msg = ViewChangeQC
e0: get_view msg = p
n: ~ In msg (snd (tr i))
{timeout_trigger_message_global tr i p msg} +
{~ timeout_trigger_message_global tr i p msg}
    +tr: GTrace
i, p: nat
msg: message
e: get_message_type msg = ViewChangeQC
e0: get_view msg = p
i0: In msg (snd (tr i))
{timeout_trigger_message_global tr i p msg} +
{~ timeout_trigger_message_global tr i p msg} left.tr: GTrace
i, p: nat
msg: message
e: get_message_type msg = ViewChangeQC
e0: get_view msg = p
i0: In msg (snd (tr i))
timeout_trigger_message_global tr i p msg
      split; [assumption|].tr: GTrace
i, p: nat
msg: message
e: get_message_type msg = ViewChangeQC
e0: get_view msg = p
i0: In msg (snd (tr i))
get_view msg = p /\ In msg (snd (tr i))
      split; [assumption|].tr: GTrace
i, p: nat
msg: message
e: get_message_type msg = ViewChangeQC
e0: get_view msg = p
i0: In msg (snd (tr i))
In msg (snd (tr i))
      assumption.
    +tr: GTrace
i, p: nat
msg: message
e: get_message_type msg = ViewChangeQC
e0: get_view msg = p
n: ~ In msg (snd (tr i))
{timeout_trigger_message_global tr i p msg} +
{~ timeout_trigger_message_global tr i p msg} right.tr: GTrace
i, p: nat
msg: message
e: get_message_type msg = ViewChangeQC
e0: get_view msg = p
n: ~ In msg (snd (tr i))
~ timeout_trigger_message_global tr i p msg
      intro.tr: GTrace
i, p: nat
msg: message
e: get_message_type msg = ViewChangeQC
e0: get_view msg = p
n: ~ In msg (snd (tr i))
H: timeout_trigger_message_global tr i p msg
False
      destruct H.tr: GTrace
i, p: nat
msg: message
e: get_message_type msg = ViewChangeQC
e0: get_view msg = p
n: ~ In msg (snd (tr i))
H: get_message_type msg = ViewChangeQC
H0: get_view msg = p /\ In msg (snd (tr i))
False
      destruct H0.tr: GTrace
i, p: nat
msg: message
e: get_message_type msg = ViewChangeQC
e0: get_view msg = p
n: ~ In msg (snd (tr i))
H: get_message_type msg = ViewChangeQC
H0: get_view msg = p
H1: In msg (snd (tr i))
False
      auto.
  *tr: GTrace
i, p: nat
msg: message
e: get_message_type msg = ViewChangeQC
n: get_view msg <> p
{timeout_trigger_message_global tr i p msg} +
{~ timeout_trigger_message_global tr i p msg} right.tr: GTrace
i, p: nat
msg: message
e: get_message_type msg = ViewChangeQC
n: get_view msg <> p
~ timeout_trigger_message_global tr i p msg
    intro.tr: GTrace
i, p: nat
msg: message
e: get_message_type msg = ViewChangeQC
n: get_view msg <> p
H: timeout_trigger_message_global tr i p msg
False
    destruct H.tr: GTrace
i, p: nat
msg: message
e: get_message_type msg = ViewChangeQC
n: get_view msg <> p
H: get_message_type msg = ViewChangeQC
H0: get_view msg = p /\ In msg (snd (tr i))
False
    destruct H0.tr: GTrace
i, p: nat
msg: message
e: get_message_type msg = ViewChangeQC
n: get_view msg <> p
H: get_message_type msg = ViewChangeQC
H0: get_view msg = p
H1: In msg (snd (tr i))
False
    congruence.
-tr: GTrace
i, p: nat
msg: message
n: get_message_type msg <> ViewChangeQC
{timeout_trigger_message_global tr i p msg} +
{~ timeout_trigger_message_global tr i p msg} right.tr: GTrace
i, p: nat
msg: message
n: get_message_type msg <> ViewChangeQC
~ timeout_trigger_message_global tr i p msg
  intro.tr: GTrace
i, p: nat
msg: message
n: get_message_type msg <> ViewChangeQC
H: timeout_trigger_message_global tr i p msg
False
  destruct H.tr: GTrace
i, p: nat
msg: message
n: get_message_type msg <> ViewChangeQC
H: get_message_type msg = ViewChangeQC
H0: get_view msg = p /\ In msg (snd (tr i))
False
  congruence.
Defined.

Definition trigger_message_global (tr : GTrace) (i : nat) (p : nat) (msg : message) :=
  normal_trigger_message_global tr i p msg \/
  timeout_trigger_message_global tr i p msg.

If a view change occurs locally from i ~> S i for node n, there must exist a trigger message signed with i's view in global state (S i)'s message buffer.

Lemma view_increment_exists_trigger_message_global :
  forall (tr : GTrace), protocol_trace tr ->
  forall (n : node) (i : nat), In n participants ->
   S (node_view (fst (tr i) n)) = node_view (fst (tr (S i)) n) ->
  exists msg : message,
    trigger_message_global tr (S i) (node_view (fst (tr i) n)) msg.forall tr : GTrace,
protocol_trace tr ->
forall (n : node) (i : nat),
In n participants ->
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n) ->
exists msg : message,
  trigger_message_global tr (S i)
    (node_view (fst (tr i) n)) msg
Proof.forall tr : GTrace,
protocol_trace tr ->
forall (n : node) (i : nat),
In n participants ->
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n) ->
exists msg : message,
  trigger_message_global tr (S i)
    (node_view (fst (tr i) n)) msg 
  intros tr H_prot n i H_part H_incr.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
exists msg : message,
  trigger_message_global tr (S i)
    (node_view (fst (tr i) n)) msg
  assert (H_prot_copy := H_prot); 
    destruct H_prot as [_ H_prot];
    spec H_prot i;
    destruct H_prot as [[n0 [H_in0 [p0 [msg0 [lm0 [H_step H_deliver]]]]]] | H_timeout].tr: GTrace
n: node
i: nat
H_part: In n participants
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
exists msg : message,
  trigger_message_global tr 
    (S i) (node_view (fst (tr i) n)) msg
tr: GTrace
n: node
i: nat
H_part: In n participants
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
exists msg : message,
  trigger_message_global tr 
    (S i) (node_view (fst (tr i) n)) msg
  - (* In the transition case *)tr: GTrace
n: node
i: nat
H_part: In n participants
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
exists msg : message,
  trigger_message_global tr 
    (S i) (node_view (fst (tr i) n)) msg 
    (* Establishing that n0 = n *) 
    assert (H_useful := @view_different_tells_receiver tr i n p0 n0 msg0 lm0 H_prot_copy H_part).tr: GTrace
n: node
i: nat
H_part: In n participants
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_useful: node_view (fst (tr i) n) <>
node_view (fst (tr (S i)) n) ->
get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0 ->
tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0 ->
n0 = n
exists msg : message,
  trigger_message_global tr 
    (S i) (node_view (fst (tr i) n)) msg
    spec H_useful.tr: GTrace
n: node
i: nat
H_part: In n participants
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_useful: node_view (fst (tr i) n) <>
node_view (fst (tr (S i)) n) ->
get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0 ->
tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0 ->
n0 = n
node_view (fst (tr i) n) <>
node_view (fst (tr (S i)) n)
tr: GTrace
n: node
i: nat
H_part: In n participants
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_useful: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0 ->
tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0 ->
n0 = n
exists msg : message,
  trigger_message_global tr 
    (S i) (node_view (fst (tr i) n)) msg 
    lia.tr: GTrace
n: node
i: nat
H_part: In n participants
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_useful: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0 ->
tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0 ->
n0 = n
exists msg : message,
  trigger_message_global tr 
    (S i) (node_view (fst (tr i) n)) msg
    spec H_useful H_step H_deliver.tr: GTrace
n: node
i: nat
H_part: In n participants
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_useful: n0 = n
exists msg : message,
  trigger_message_global tr 
    (S i) (node_view (fst (tr i) n)) msg 
    subst.tr: GTrace
n: node
i: nat
H_part: In n participants
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_prot_copy: protocol_trace tr
H_in0: In n participants
p0: NState_transition_type
msg0: message
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_step: get_transition p0 (fst (tr i) n) msg0
  (fst (tr (S i)) n) lm0
exists msg : message,
  trigger_message_global tr 
    (S i) (node_view (fst (tr i) n)) msg 
    destruct p0;
      assert (H_step_copy := H_step);
      destruct H_step as [H_update [H_out H_rest]];
      unfold view_valid in H_rest;
      try (rewrite H_update in H_incr;
           simpl in H_incr;
           lia);
      (* In the cases of PrepareQC last block *) 
      try (exists msg0; left; repeat split;
             try tauto; try (symmetry; tauto);
             apply global_messages_monotonic_step;
             try assumption; try tauto;
             now apply delivered_means_sent_global with n);
    (* In the case of ViewChange quorum received by the new proposer *) 
    try (exists (make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message (process (fst (tr i) n) msg0))); right;
     repeat split; try tauto; try (symmetry; tauto);
    rewrite H_deliver, H_out;
    simpl; tauto); 
    (* In the case of ViewChangeQC received by validators *) 
    try (exists msg0; right; repeat split;
           try tauto; try (symmetry; tauto);
           apply global_messages_monotonic_step;
           try assumption; try tauto;
           now apply delivered_means_sent_global with n). 
  -tr: GTrace
n: node
i: nat
H_part: In n participants
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
exists msg : message,
  trigger_message_global tr 
    (S i) (node_view (fst (tr i) n)) msg rewrite H_timeout in H_incr;
      simpl in H_incr;
      apply is_member_correct in H_part;
      rewrite H_part in H_incr;
      inversion H_incr;
      lia.
Qed.

Any global broadcast message buffer must contain trigger messages for all its past views, from the view of a particular participant.

Lemma past_view_exists_trigger_message_global :
  forall tr,
    protocol_trace tr ->
    forall n i,
      In n participants ->
      forall v_past,
        v_past < node_view (fst (tr i) n) ->
        exists msg,
          trigger_message_global tr i v_past msg.forall tr : GTrace,
protocol_trace tr ->
forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg 
Proof.forall tr : GTrace,
protocol_trace tr ->
forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg   
  intros tr H_prot n i H_part v_past H_past.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr i) n)
exists msg : message,
  trigger_message_global tr i v_past msg
  induction i as [|i IH_prot].tr: GTrace
H_prot: protocol_trace tr
n: node
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr 0) n)
exists msg : message,
  trigger_message_global tr 0 v_past msg
tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
IH_prot: v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg : message,
  trigger_message_global tr (S i) v_past msg 
  -tr: GTrace
H_prot: protocol_trace tr
n: node
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr 0) n)
exists msg : message,
  trigger_message_global tr 0 v_past msg destruct H_prot as [H_init _];
      rewrite H_init in H_past;
      inversion H_past.
  -tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
IH_prot: v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg : message,
  trigger_message_global tr (S i) v_past msg assert (H_view := @view_same_or_plus_one tr i n H_prot H_part).tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
IH_prot: v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
exists msg : message,
  trigger_message_global tr (S i) v_past msg
    destruct H_view as [H_same | H_incr].tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
IH_prot: v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
H_same: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n)
exists msg : message,
  trigger_message_global tr (S i) v_past msg
tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
IH_prot: v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
exists msg : message,
  trigger_message_global tr (S i) v_past msg
    + (* In the case that no view change occurred from i ~> S i *)tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
IH_prot: v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
H_same: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n)
exists msg : message,
  trigger_message_global tr (S i) v_past msg
      spec IH_prot.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
IH_prot: v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
H_same: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n)
v_past < node_view (fst (tr i) n)
tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
H_same: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n)
IH_prot: exists msg : message,
  trigger_message_global tr i v_past msg
exists msg : message,
  trigger_message_global tr (S i) v_past msg lia.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
H_same: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n)
IH_prot: exists msg : message,
  trigger_message_global tr i v_past msg
exists msg : message,
  trigger_message_global tr (S i) v_past msg 
      destruct IH_prot as [msg H_trigger].tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
H_same: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n)
msg: message
H_trigger: trigger_message_global tr i v_past msg
exists msg : message,
  trigger_message_global tr (S i) v_past msg
      exists msg.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
H_same: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n)
msg: message
H_trigger: trigger_message_global tr i v_past msg
trigger_message_global tr (S i) v_past msg
      destruct H_trigger as [H_normal | H_abnormal].tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
H_same: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n)
msg: message
H_normal: normal_trigger_message_global tr i v_past
  msg
trigger_message_global tr (S i) v_past msg
tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
H_same: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n)
msg: message
H_abnormal: timeout_trigger_message_global tr i
  v_past msg
trigger_message_global tr (S i) v_past msg
      left; red in H_normal; repeat split; try tauto.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
H_same: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n)
msg: message
H_normal: get_message_type msg = PrepareQC /\
get_view msg = v_past /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
In msg (snd (tr (S i)))
tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
H_same: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n)
msg: message
H_abnormal: timeout_trigger_message_global tr i
  v_past msg
trigger_message_global tr (S i) v_past msg
      now apply global_messages_monotonic_step.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
H_same: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n)
msg: message
H_abnormal: timeout_trigger_message_global tr i
  v_past msg
trigger_message_global tr (S i) v_past msg
      right; red in H_abnormal; repeat split; try tauto.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
H_same: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n)
msg: message
H_abnormal: get_message_type msg = ViewChangeQC /\
get_view msg = v_past /\
In msg (snd (tr i))
In msg (snd (tr (S i)))
      destruct H_abnormal as [_ [_ H_out]].tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
H_same: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n)
msg: message
H_out: In msg (snd (tr i))
In msg (snd (tr (S i)))
      now apply global_messages_monotonic_step.
    + (* In the case that a view change occurred from i ~> S i *)tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
IH_prot: v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
exists msg : message,
  trigger_message_global tr (S i) v_past msg
      assert (v_past < node_view (fst (tr (S i)) n) - 1 \/
              v_past = node_view (fst (tr (S i)) n) - 1) by lia.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
IH_prot: v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H: v_past < node_view (fst (tr (S i)) n) - 1 \/
v_past = node_view (fst (tr (S i)) n) - 1
exists msg : message,
  trigger_message_global tr (S i) v_past msg 
      destruct H as [H_lt | H_eq].tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
IH_prot: v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_lt: v_past < node_view (fst (tr (S i)) n) - 1
exists msg : message,
  trigger_message_global tr (S i) v_past msg
tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
IH_prot: v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_eq: v_past = node_view (fst (tr (S i)) n) - 1
exists msg : message,
  trigger_message_global tr (S i) v_past msg
      *tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
IH_prot: v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_lt: v_past < node_view (fst (tr (S i)) n) - 1
exists msg : message,
  trigger_message_global tr (S i) v_past msg spec IH_prot.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
IH_prot: v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_lt: v_past < node_view (fst (tr (S i)) n) - 1
v_past < node_view (fst (tr i) n)
tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_lt: v_past < node_view (fst (tr (S i)) n) - 1
IH_prot: exists msg : message,
  trigger_message_global tr i v_past msg
exists msg : message,
  trigger_message_global tr (S i) v_past msg
        lia.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_lt: v_past < node_view (fst (tr (S i)) n) - 1
IH_prot: exists msg : message,
  trigger_message_global tr i v_past msg
exists msg : message,
  trigger_message_global tr (S i) v_past msg
        destruct IH_prot as [msg H_trigger].tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_lt: v_past < node_view (fst (tr (S i)) n) - 1
msg: message
H_trigger: trigger_message_global tr i v_past msg
exists msg : message,
  trigger_message_global tr (S i) v_past msg
        exists msg.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_lt: v_past < node_view (fst (tr (S i)) n) - 1
msg: message
H_trigger: trigger_message_global tr i v_past msg
trigger_message_global tr (S i) v_past msg
        destruct H_trigger as [H_normal | H_abnormal].tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_lt: v_past < node_view (fst (tr (S i)) n) - 1
msg: message
H_normal: normal_trigger_message_global tr i v_past
  msg
trigger_message_global tr (S i) v_past msg
tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_lt: v_past < node_view (fst (tr (S i)) n) - 1
msg: message
H_abnormal: timeout_trigger_message_global tr i
  v_past msg
trigger_message_global tr (S i) v_past msg
        left; red in H_normal; repeat split; try tauto.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_lt: v_past < node_view (fst (tr (S i)) n) - 1
msg: message
H_normal: get_message_type msg = PrepareQC /\
get_view msg = v_past /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
In msg (snd (tr (S i)))
tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_lt: v_past < node_view (fst (tr (S i)) n) - 1
msg: message
H_abnormal: timeout_trigger_message_global tr i
  v_past msg
trigger_message_global tr (S i) v_past msg
        now apply global_messages_monotonic_step.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_lt: v_past < node_view (fst (tr (S i)) n) - 1
msg: message
H_abnormal: timeout_trigger_message_global tr i
  v_past msg
trigger_message_global tr (S i) v_past msg
        right; red in H_abnormal; repeat split; try tauto.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_lt: v_past < node_view (fst (tr (S i)) n) - 1
msg: message
H_abnormal: get_message_type msg = ViewChangeQC /\
get_view msg = v_past /\
In msg (snd (tr i))
In msg (snd (tr (S i)))
        now apply global_messages_monotonic_step.
      * (* This is the tricky case *)tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
IH_prot: v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_eq: v_past = node_view (fst (tr (S i)) n) - 1
exists msg : message,
  trigger_message_global tr (S i) v_past msg
        assert (H_view : v_past = node_view (fst (tr i) n)) by lia.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_past: v_past < node_view (fst (tr (S i)) n)
IH_prot: v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_eq: v_past = node_view (fst (tr (S i)) n) - 1
H_view: v_past = node_view (fst (tr i) n)
exists msg : message,
  trigger_message_global tr (S i) v_past msg 
        clear IH_prot H_eq H_past.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
v_past: nat
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_view: v_past = node_view (fst (tr i) n)
exists msg : message,
  trigger_message_global tr (S i) v_past msg
        subst.tr: GTrace
H_prot: protocol_trace tr
n: node
i: nat
H_part: In n participants
H_incr: S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
exists msg : message,
  trigger_message_global tr 
    (S i) (node_view (fst (tr i) n)) msg
        now apply view_increment_exists_trigger_message_global. 
Qed.

Trigger messages that exist in global state (S i) exist in global state i as long as the sender of the message did not make the transition from i ~> S i:

Lemma trigger_message_global_backwards_persistent_verbose :
  forall (tr : GTrace), protocol_trace tr ->
  forall (i p : nat) (n : node), In n participants ->
  forall (msg : message), trigger_message_global tr (S i) p msg ->
  forall (n0 : node) (p0 : NState_transition_type) (msg0 : message) (lm0 : list message),
   In n0 participants ->
   get_transition p0 (fst (tr i) n0) msg0 (fst (tr (S i)) n0) lm0 ->
   tr (S i) = broadcast_messages (tr i) (fst (tr i) n0) (fst (tr (S i)) n0) lm0 ->
   n0 <> get_sender msg ->
   trigger_message_global tr i p msg.forall tr : GTrace,
protocol_trace tr ->
forall (i p : nat) (n : node),
In n participants ->
forall msg : message,
trigger_message_global tr (S i) p msg ->
forall (n0 : node) (p0 : NState_transition_type)
  (msg0 : message) (lm0 : list message),
In n0 participants ->
get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0 ->
tr (S i) =
broadcast_messages (tr i) (fst (tr i) n0)
  (fst (tr (S i)) n0) lm0 ->
n0 <> get_sender msg ->
trigger_message_global tr i p msg
Proof.forall tr : GTrace,
protocol_trace tr ->
forall (i p : nat) (n : node),
In n participants ->
forall msg : message,
trigger_message_global tr (S i) p msg ->
forall (n0 : node) (p0 : NState_transition_type)
  (msg0 : message) (lm0 : list message),
In n0 participants ->
get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0 ->
tr (S i) =
broadcast_messages (tr i) (fst (tr i) n0)
  (fst (tr (S i)) n0) lm0 ->
n0 <> get_sender msg ->
trigger_message_global tr i p msg  
  intros tr H_prot_copy i p n H_part msg H_trigger n0 p0 msg0 lm0 H_in0 H_step H_deliver H_neq.tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
H_trigger: trigger_message_global tr (S i) p msg
n0: node
p0: NState_transition_type
msg0: message
lm0: list message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
trigger_message_global tr i p msg
  destruct H_trigger as [H_normal | H_timeout].tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
H_normal: normal_trigger_message_global tr 
  (S i) p msg
n0: node
p0: NState_transition_type
msg0: message
lm0: list message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
trigger_message_global tr i p msg
tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
H_timeout: timeout_trigger_message_global tr 
  (S i) p msg
n0: node
p0: NState_transition_type
msg0: message
lm0: list message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
trigger_message_global tr i p msg
  -tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
H_normal: normal_trigger_message_global tr 
  (S i) p msg
n0: node
p0: NState_transition_type
msg0: message
lm0: list message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
trigger_message_global tr i p msg left; red in H_normal; repeat split; try tauto.tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
H_normal: get_message_type msg = PrepareQC /\
get_view msg = p /\
b_last (get_block msg) = true /\
In msg (snd (tr (S i)))
n0: node
p0: NState_transition_type
msg0: message
lm0: list message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
In msg (snd (tr i))
    destruct H_normal as [_ [_ [_ H_in]]].tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
H_in: In msg (snd (tr (S i)))
n0: node
p0: NState_transition_type
msg0: message
lm0: list message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
In msg (snd (tr i))
    rewrite H_deliver in H_in.tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
n0: node
lm0: list message
H_in: In msg
  (snd
     (broadcast_messages 
        (tr i) (fst (tr i) n0)
        (fst (tr (S i)) n0) lm0))
p0: NState_transition_type
msg0: message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
In msg (snd (tr i))
    simpl in H_in.tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
n0: node
lm0: list message
H_in: In msg (lm0 ++ snd (tr i))
p0: NState_transition_type
msg0: message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
In msg (snd (tr i))
    rewrite in_app_iff in H_in;
    destruct H_in as [H_false | H_goal]; try assumption.tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
n0: node
lm0: list message
H_false: In msg lm0
p0: NState_transition_type
msg0: message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
In msg (snd (tr i))
    assert (H_useful := delivered_means_sender_made_transition).tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
n0: node
lm0: list message
H_false: In msg lm0
p0: NState_transition_type
msg0: message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
H_useful: forall tr : GTrace,
protocol_trace tr ->
forall (i : nat) (msg : message)
  (n0 : node) (lm0 : list message),
In msg lm0 ->
In n0 participants ->
forall (p0 : NState_transition_type)
  (msg0 : message),
get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0 ->
tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0 ->
get_sender msg = n0
In msg (snd (tr i)) 
    spec H_useful tr H_prot_copy i msg n0 lm0 H_false H_in0.tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
n0: node
lm0: list message
H_false: In msg lm0
p0: NState_transition_type
msg0: message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
H_useful: forall (p0 : NState_transition_type)
  (msg0 : message),
get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0 ->
tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0 ->
get_sender msg = n0
In msg (snd (tr i))
    spec H_useful p0 msg0 H_step H_deliver.tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
n0: node
lm0: list message
H_false: In msg lm0
p0: NState_transition_type
msg0: message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
H_useful: get_sender msg = n0
In msg (snd (tr i))
    symmetry in H_useful.tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
n0: node
lm0: list message
H_false: In msg lm0
p0: NState_transition_type
msg0: message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
H_useful: n0 = get_sender msg
In msg (snd (tr i)) contradiction.
  -tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
H_timeout: timeout_trigger_message_global tr 
  (S i) p msg
n0: node
p0: NState_transition_type
msg0: message
lm0: list message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
trigger_message_global tr i p msg right; red in H_timeout; repeat split; try tauto.tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
H_timeout: get_message_type msg = ViewChangeQC /\
get_view msg = p /\
In msg (snd (tr (S i)))
n0: node
p0: NState_transition_type
msg0: message
lm0: list message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
In msg (snd (tr i)) 
    destruct H_timeout as [_ [_ H_in]].tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
H_in: In msg (snd (tr (S i)))
n0: node
p0: NState_transition_type
msg0: message
lm0: list message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
In msg (snd (tr i))
    rewrite H_deliver in H_in.tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
n0: node
lm0: list message
H_in: In msg
  (snd
     (broadcast_messages 
        (tr i) (fst (tr i) n0)
        (fst (tr (S i)) n0) lm0))
p0: NState_transition_type
msg0: message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
In msg (snd (tr i))
    simpl in H_in.tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
n0: node
lm0: list message
H_in: In msg (lm0 ++ snd (tr i))
p0: NState_transition_type
msg0: message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
In msg (snd (tr i))
    rewrite in_app_iff in H_in;
    destruct H_in as [H_false | H_goal]; try assumption.tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
n0: node
lm0: list message
H_false: In msg lm0
p0: NState_transition_type
msg0: message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
In msg (snd (tr i))
    assert (H_useful := delivered_means_sender_made_transition).tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
n0: node
lm0: list message
H_false: In msg lm0
p0: NState_transition_type
msg0: message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
H_useful: forall tr : GTrace,
protocol_trace tr ->
forall (i : nat) (msg : message)
  (n0 : node) (lm0 : list message),
In msg lm0 ->
In n0 participants ->
forall (p0 : NState_transition_type)
  (msg0 : message),
get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0 ->
tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0 ->
get_sender msg = n0
In msg (snd (tr i)) 
    spec H_useful tr H_prot_copy i msg n0 lm0 H_false H_in0.tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
n0: node
lm0: list message
H_false: In msg lm0
p0: NState_transition_type
msg0: message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
H_useful: forall (p0 : NState_transition_type)
  (msg0 : message),
get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0 ->
tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0 ->
get_sender msg = n0
In msg (snd (tr i))
    spec H_useful p0 msg0 H_step H_deliver.tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
n0: node
lm0: list message
H_false: In msg lm0
p0: NState_transition_type
msg0: message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
H_useful: get_sender msg = n0
In msg (snd (tr i))
    symmetry in H_useful.tr: GTrace
H_prot_copy: protocol_trace tr
i, p: nat
n: node
H_part: In n participants
msg: message
n0: node
lm0: list message
H_false: In msg lm0
p0: NState_transition_type
msg0: message
H_in0: In n0 participants
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_neq: n0 <> get_sender msg
H_useful: n0 = get_sender msg
In msg (snd (tr i)) contradiction.
Qed.

Finally, an important property of trigger messages is that their blocks are in global prepare stage in the current view. In the normal trigger message case, this is direct by definition: PrepareQC suffices to enter a block into prepare stage. In the abnormal trigger message case, we require a few supplementary facts:

The block contained in ViewChange messages is at global prepare stage:

Lemma ViewChange_message_block_prepare_stage_global :
  forall (tr : GTrace) (i p : nat) (msg : message),
    protocol_trace tr ->
    get_message_type msg = ViewChange /\ get_view msg = p /\ In msg (snd (tr i)) ->
    prepare_stage_in_view_global tr i (get_block msg) p.forall (tr : GTrace) (i p : nat) (msg : message),
protocol_trace tr ->
get_message_type msg = ViewChange /\
get_view msg = p /\ In msg (snd (tr i)) ->
prepare_stage_in_view_global tr i (get_block msg) p
Proof.forall (tr : GTrace) (i p : nat) (msg : message),
protocol_trace tr ->
get_message_type msg = ViewChange /\
get_view msg = p /\ In msg (snd (tr i)) ->
prepare_stage_in_view_global tr i (get_block msg) p
  intros tr i p msg H_prot H_abnormal.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_abnormal: get_message_type msg = ViewChange /\
get_view msg = p /\ In msg (snd (tr i))
prepare_stage_in_view_global tr i (get_block msg) p
  destruct H_abnormal as [H_type [H_view H_in]].tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = ViewChange
H_view: get_view msg = p
H_in: In msg (snd (tr i))
prepare_stage_in_view_global tr i (get_block msg) p 
  induction i as [|i IH_prot].tr: GTrace
p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = ViewChange
H_view: get_view msg = p
H_in: In msg (snd (tr 0))
prepare_stage_in_view_global tr 0 (get_block msg) p
tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = ViewChange
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
IH_prot: In msg (snd (tr i)) ->
prepare_stage_in_view_global tr i
  (get_block msg) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
  -tr: GTrace
p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = ViewChange
H_view: get_view msg = p
H_in: In msg (snd (tr 0))
prepare_stage_in_view_global tr 0 (get_block msg) p destruct H_prot as [H_init _];
      rewrite H_init in H_in;
      easy.
  -tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = ViewChange
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
IH_prot: In msg (snd (tr i)) ->
prepare_stage_in_view_global tr i
  (get_block msg) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p destruct (In_dec message_eq_dec msg (snd (tr i))) as [H_old | H_new].tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = ViewChange
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
IH_prot: In msg (snd (tr i)) ->
prepare_stage_in_view_global tr i
  (get_block msg) p
H_old: In msg (snd (tr i))
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = ViewChange
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
IH_prot: In msg (snd (tr i)) ->
prepare_stage_in_view_global tr i
  (get_block msg) p
H_new: ~ In msg (snd (tr i))
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
    +tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = ViewChange
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
IH_prot: In msg (snd (tr i)) ->
prepare_stage_in_view_global tr i
  (get_block msg) p
H_old: In msg (snd (tr i))
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p apply prepare_stage_in_view_step_global; tauto.
    +tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = ViewChange
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
IH_prot: In msg (snd (tr i)) ->
prepare_stage_in_view_global tr i
  (get_block msg) p
H_new: ~ In msg (snd (tr i))
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p clear IH_prot.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = ViewChange
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
H_new: ~ In msg (snd (tr i))
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
      assert (H_prot_copy := H_prot); 
        destruct H_prot as [_ H_prot];
        spec H_prot i;
        destruct H_prot as [[n0 [H_in0 [p0 [msg0 [lm0 [H_step H_deliver]]]]]] | H_timeout].tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChange
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChange
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
      *tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChange
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p rewrite H_deliver in H_in;
          simpl in H_in;
          destruct p0;
          destruct H_step as [H_update [H_out H_rest]];
          rewrite H_out in H_in;
          simpl in H_in;
          try rewrite in_app_iff in H_in;
          repeat destruct H_in as [H_in | H_in];
          try contradiction;
          try (rewrite <- H_in in H_type;
               simpl in H_type;
               discriminate);
          try (apply pending_PrepareVote_correct in H_in;
               rewrite H_type in H_in;
               easy);
          try (subst; rewrite H_type in H_rest; easy). 
      *tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChange
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p rewrite H_timeout in H_in.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChange
H_view: get_view msg = p
H_in: In msg
  (snd
     (fun n : node =>
      if is_member n participants
      then flip_timeout (fst (tr i) n)
      else fst (tr i) n, 
      snd (tr i)))
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p 
        simpl in H_in.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChange
H_view: get_view msg = p
H_in: In msg (snd (tr i))
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        contradiction.
Qed.

The block contained in timeout trigger messages is at global prepare stage:

Lemma timeout_trigger_message_block_prepare_stage_global :
  forall (tr : GTrace) (i p : nat) (msg : message),
  protocol_trace tr ->
  get_message_type msg = ViewChangeQC /\ get_view msg = p /\ In msg (snd (tr i)) ->
  prepare_stage_in_view_global tr i (get_block msg) p.forall (tr : GTrace) (i p : nat) (msg : message),
protocol_trace tr ->
get_message_type msg = ViewChangeQC /\
get_view msg = p /\ In msg (snd (tr i)) ->
prepare_stage_in_view_global tr i (get_block msg) p
Proof.forall (tr : GTrace) (i p : nat) (msg : message),
protocol_trace tr ->
get_message_type msg = ViewChangeQC /\
get_view msg = p /\ In msg (snd (tr i)) ->
prepare_stage_in_view_global tr i (get_block msg) p 
  intros tr i p msg H_prot H_abnormal.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_abnormal: get_message_type msg = ViewChangeQC /\
get_view msg = p /\ In msg (snd (tr i))
prepare_stage_in_view_global tr i (get_block msg) p
  destruct H_abnormal as [H_type [H_view H_in]].tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
H_in: In msg (snd (tr i))
prepare_stage_in_view_global tr i (get_block msg) p 
  induction i as [|i IH_prot].tr: GTrace
p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
H_in: In msg (snd (tr 0))
prepare_stage_in_view_global tr 0 (get_block msg) p
tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
IH_prot: In msg (snd (tr i)) ->
prepare_stage_in_view_global tr i
  (get_block msg) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
  -tr: GTrace
p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
H_in: In msg (snd (tr 0))
prepare_stage_in_view_global tr 0 (get_block msg) p destruct H_prot as [H_init _];
      rewrite H_init in H_in;
      easy.
  -tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
IH_prot: In msg (snd (tr i)) ->
prepare_stage_in_view_global tr i
  (get_block msg) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p destruct (In_dec message_eq_dec msg (snd (tr i))) as [H_old | H_new].tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
IH_prot: In msg (snd (tr i)) ->
prepare_stage_in_view_global tr i
  (get_block msg) p
H_old: In msg (snd (tr i))
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
IH_prot: In msg (snd (tr i)) ->
prepare_stage_in_view_global tr i
  (get_block msg) p
H_new: ~ In msg (snd (tr i))
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
    +tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
IH_prot: In msg (snd (tr i)) ->
prepare_stage_in_view_global tr i
  (get_block msg) p
H_old: In msg (snd (tr i))
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p apply prepare_stage_in_view_step_global; tauto.
    +tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
IH_prot: In msg (snd (tr i)) ->
prepare_stage_in_view_global tr i
  (get_block msg) p
H_new: ~ In msg (snd (tr i))
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p clear IH_prot.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
H_new: ~ In msg (snd (tr i))
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
      assert (H_prot_copy := H_prot); 
        destruct H_prot as [_ H_prot];
        spec H_prot i;
        destruct H_prot as [[n0 [H_in0 [p0 [msg0 [lm0 [H_step H_deliver]]]]]] | H_timeout].tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
      *tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p rewrite H_deliver in H_in;
          simpl in H_in;
          destruct p0;
          assert (H_step_copy := H_step); 
          destruct H_step as [H_update [H_out H_rest]];
          rewrite H_out in H_in;
          simpl in H_in;
          try rewrite in_app_iff in H_in;
          repeat destruct H_in as [H_in | H_in];
          try contradiction;
          try (rewrite <- H_in in H_type;
               simpl in H_type;
               discriminate);
          try (apply pending_PrepareVote_correct in H_in;
               rewrite H_type in H_in;
               easy);
          try (subst; rewrite H_type in H_rest; easy).tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        (* In the ViewChange quorum case *)
        assert (H_useful := ViewChange_message_block_prepare_stage_global).tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: forall (tr : GTrace) (i p : nat)
  (msg : message),
protocol_trace tr ->
get_message_type msg = ViewChange /\
get_view msg = p /\ In msg (snd (tr i)) ->
prepare_stage_in_view_global tr i
  (get_block msg) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        spec H_useful tr (S i) p (highest_ViewChange_message (process (fst (tr i) n0) msg0)) H_prot_copy.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        spec H_useful; repeat split.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = ViewChange
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        (* Discharging the message type obligation *)
        apply highest_ViewChange_message_type_eq_ViewChange.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p 
        (* Discharging the view obligation *)
        assert (H_goal := get_view_highest_ViewChange_message_node_view).tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: forall (s : NState) (msg : message),
get_message_type msg = ViewChange ->
get_view msg = node_view s ->
In msg (counting_messages s) ->
get_view (highest_ViewChange_message s) =
node_view s
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        spec H_goal (process (fst (tr i) n0) msg0).tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: forall msg : message,
get_message_type msg = ViewChange ->
get_view msg =
node_view (process (fst (tr i) n0) msg0) ->
In msg
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
node_view (process (fst (tr i) n0) msg0)
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        spec H_goal msg0.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: get_message_type msg0 = ViewChange ->
get_view msg0 =
node_view (process (fst (tr i) n0) msg0) ->
In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
node_view (process (fst (tr i) n0) msg0)
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p spec H_goal.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: get_message_type msg0 = ViewChange ->
get_view msg0 =
node_view (process (fst (tr i) n0) msg0) ->
In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
node_view (process (fst (tr i) n0) msg0)
get_message_type msg0 = ViewChange
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: get_view msg0 =
node_view (process (fst (tr i) n0) msg0) ->
In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
node_view (process (fst (tr i) n0) msg0)
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        tauto.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: get_view msg0 =
node_view (process (fst (tr i) n0) msg0) ->
In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
node_view (process (fst (tr i) n0) msg0)
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p spec H_goal.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: get_view msg0 =
node_view (process (fst (tr i) n0) msg0) ->
In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
node_view (process (fst (tr i) n0) msg0)
get_view msg0 =
node_view (process (fst (tr i) n0) msg0)
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
node_view (process (fst (tr i) n0) msg0)
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p simpl.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: get_view msg0 =
node_view (process (fst (tr i) n0) msg0) ->
In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
node_view (process (fst (tr i) n0) msg0)
get_view msg0 = node_view (fst (tr i) n0)
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
node_view (process (fst (tr i) n0) msg0)
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        unfold view_valid in H_rest.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
node_view (fst (tr i) n0) = get_view msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: get_view msg0 =
node_view (process (fst (tr i) n0) msg0) ->
In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
node_view (process (fst (tr i) n0) msg0)
get_view msg0 = node_view (fst (tr i) n0)
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
node_view (process (fst (tr i) n0) msg0)
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        lia.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
node_view (process (fst (tr i) n0) msg0)
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        spec H_goal.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
node_view (process (fst (tr i) n0) msg0)
In msg0
  (counting_messages (process (fst (tr i) n0) msg0))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
node_view (process (fst (tr i) n0) msg0)
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p simpl.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
node_view (process (fst (tr i) n0) msg0)
msg0 = msg0 \/
In msg0 (counting_messages (fst (tr i) n0))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
node_view (process (fst (tr i) n0) msg0)
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p tauto.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
node_view (process (fst (tr i) n0) msg0)
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        rewrite H_goal.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
node_view (process (fst (tr i) n0) msg0)
node_view (process (fst (tr i) n0) msg0) = p
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        rewrite <- H_view.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
node_view (process (fst (tr i) n0) msg0)
node_view (process (fst (tr i) n0) msg0) =
get_view msg
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        rewrite <- H_in.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
node_view (process (fst (tr i) n0) msg0)
node_view (process (fst (tr i) n0) msg0) =
get_view
  (make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        simpl.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
node_view (process (fst (tr i) n0) msg0)
node_view (fst (tr i) n0) = node_view (fst (tr i) n0)
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p reflexivity.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        (* Discharging the membership obligation *)
        assert (H_goal := get_view_highest_ViewChange_message_in_counting_messages).tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: forall (s : NState) (msg : message),
get_message_type msg = ViewChange ->
get_view msg = node_view s ->
In msg (counting_messages s) ->
In (highest_ViewChange_message s)
  (counting_messages s)
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p 
        spec H_goal (process (fst (tr i) n0) msg0) msg0.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: get_message_type msg0 = ViewChange ->
get_view msg0 =
node_view (process (fst (tr i) n0) msg0) ->
In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages
     (process (fst (tr i) n0) msg0))
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        spec H_goal.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: get_message_type msg0 = ViewChange ->
get_view msg0 =
node_view (process (fst (tr i) n0) msg0) ->
In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages
     (process (fst (tr i) n0) msg0))
get_message_type msg0 = ViewChange
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: get_view msg0 =
node_view (process (fst (tr i) n0) msg0) ->
In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages
     (process (fst (tr i) n0) msg0))
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p tauto.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: get_view msg0 =
node_view (process (fst (tr i) n0) msg0) ->
In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages
     (process (fst (tr i) n0) msg0))
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        spec H_goal.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: get_view msg0 =
node_view (process (fst (tr i) n0) msg0) ->
In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages
     (process (fst (tr i) n0) msg0))
get_view msg0 =
node_view (process (fst (tr i) n0) msg0)
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages
     (process (fst (tr i) n0) msg0))
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p simpl.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: get_view msg0 =
node_view (process (fst (tr i) n0) msg0) ->
In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages
     (process (fst (tr i) n0) msg0))
get_view msg0 = node_view (fst (tr i) n0)
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages
     (process (fst (tr i) n0) msg0))
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        unfold view_valid in H_rest.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
node_view (fst (tr i) n0) = get_view msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: get_view msg0 =
node_view (process (fst (tr i) n0) msg0) ->
In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages
     (process (fst (tr i) n0) msg0))
get_view msg0 = node_view (fst (tr i) n0)
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages
     (process (fst (tr i) n0) msg0))
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        lia.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages
     (process (fst (tr i) n0) msg0))
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        spec H_goal.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages
     (process (fst (tr i) n0) msg0))
In msg0
  (counting_messages (process (fst (tr i) n0) msg0))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages
     (process (fst (tr i) n0) msg0))
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p simpl.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: In msg0
  (counting_messages
     (process (fst (tr i) n0) msg0)) ->
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages
     (process (fst (tr i) n0) msg0))
msg0 = msg0 \/
In msg0 (counting_messages (fst (tr i) n0))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages
     (process (fst (tr i) n0) msg0))
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p tauto.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages
     (process (fst (tr i) n0) msg0))
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) 
  (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        apply processed_means_sent_global with n0; try assumption.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages
     (process (fst (tr i) n0) msg0))
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages (fst (tr (S i)) n0))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        rewrite H_update.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages
     (process (fst (tr i) n0) msg0))
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages
     (record_plural
        (increment_view
           (process (process (fst (tr i) n0) msg0)
              {|
                get_message_type := PrepareQC;
                get_view := get_view msg0;
                get_sender := get_sender msg0;
                get_block :=
                  get_block
                    (highest_ViewChange_message
                       (process (fst (tr i) n0) msg0));
                get_piggyback_block := GenesisBlock
              |}))
        ({|
           get_message_type := PrepareQC;
           get_view := node_view (fst (tr i) n0);
           get_sender := node_id (fst (tr i) n0);
           get_block :=
             get_block
               (highest_ViewChange_message
                  (process (fst (tr i) n0) msg0));
           get_piggyback_block := GenesisBlock
         |}
         :: make_ViewChangeQC 
              (fst (tr i) n0)
              (highest_ViewChange_message
                 (process (fst (tr i) n0) msg0))
            :: make_PrepareBlocks
                 (increment_view (fst (tr i) n0))
                 (highest_ViewChange_message
                    (process (fst (tr i) n0) msg0)))))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p simpl.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages
     (process (fst (tr i) n0) msg0))
{|
  get_message_type := PrepareQC;
  get_view := get_view msg0;
  get_sender := get_sender msg0;
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|} =
highest_ViewChange_message
  (process (fst (tr i) n0) msg0) \/
msg0 =
highest_ViewChange_message
  (process (fst (tr i) n0) msg0) \/
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages (fst (tr i) n0))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        right.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages
     (process (fst (tr i) n0) msg0))
msg0 =
highest_ViewChange_message
  (process (fst (tr i) n0) msg0) \/
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages (fst (tr i) n0))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p simpl in H_goal.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: get_message_type
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
ViewChange /\
get_view
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = p /\
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (snd (tr (S i))) ->
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
H_goal: msg0 =
highest_ViewChange_message
  (process (fst (tr i) n0) msg0) \/
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages (fst (tr i) n0))
msg0 =
highest_ViewChange_message
  (process (fst (tr i) n0) msg0) \/
In
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0))
  (counting_messages (fst (tr i) n0))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        assumption.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p
        rewrite <- H_in.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0)))) p
        simpl.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_useful: prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p
prepare_stage_in_view_global tr 
  (S i)
  (get_block
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))) p assumption. 
      *tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
H_new: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
prepare_stage_in_view_global tr 
  (S i) (get_block msg) p rewrite H_timeout in H_in; contradiction.
Qed.

The block contained in trigger messages is at global prepare stage:

Lemma trigger_message_block_prepare_stage_global : 
  forall tr i p msg,
    protocol_trace tr ->
    trigger_message_global tr i p msg ->
    prepare_stage_in_view_global tr i (get_block msg) p.forall (tr : GTrace) (i p : nat) (msg : message),
protocol_trace tr ->
trigger_message_global tr i p msg ->
prepare_stage_in_view_global tr i (get_block msg) p 
Proof.forall (tr : GTrace) (i p : nat) (msg : message),
protocol_trace tr ->
trigger_message_global tr i p msg ->
prepare_stage_in_view_global tr i (get_block msg) p
  intros tr i p msg H_prot H_trigger.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: trigger_message_global tr i p msg
prepare_stage_in_view_global tr i (get_block msg) p
  destruct H_trigger as [H_normal | H_abnormal].tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_normal: normal_trigger_message_global tr i p msg
prepare_stage_in_view_global tr i (get_block msg) p
tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_abnormal: timeout_trigger_message_global tr i p msg
prepare_stage_in_view_global tr i (get_block msg) p
  right; red in H_normal.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_normal: get_message_type msg = PrepareQC /\
get_view msg = p /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
PrepareQC_in_view_global tr i (get_block msg) p
tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_abnormal: timeout_trigger_message_global tr i p msg
prepare_stage_in_view_global tr i (get_block msg) p  
  exists msg; repeat split; try tauto.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_abnormal: timeout_trigger_message_global tr i p msg
prepare_stage_in_view_global tr i (get_block msg) p
  now apply timeout_trigger_message_block_prepare_stage_global. 
Qed.

These global trigger messages are significant because the blocks contained in serve as:

strict lower bounds for prepare stage blocks in the next view, and
non-strict upper bounds for prepare stage blocks in the current view.

We establish these two useful qualities about global trigger message blocks in turn.

Global trigger message blocks as lower bounds

First, we show that the height of the block contained in the trigger message for a view is the lowest height of all blocks that reach prepare stage in the next view.

More formally, we wish to establish the following:

Definition past_view_trigger_message_lowest_block_global_statement :=
  forall tr i n p msg,
    protocol_trace tr ->
    In n participants ->
    trigger_message_global tr i p msg ->
    forall b,
      prepare_stage_in_view_global tr i b (S p) ->
      b_height b > b_height (get_block msg).

We prove this by showing that the trigger message for a view carries the piggyback block for all PrepareBlock messages sent in the next view. Because the height of piggyback block in any PrepareBlock message is lower than the height of the proposed block, and all prepare stage blocks must have a PrepareBlock message, the trigger message block must be lower than the proposed block/prepare stage block. The proof of the statement above therefore requires the following ingredients:

all blocks that reach prepare stage in some view must have a PrepareBlock message in the global message buffer in that view, and
the piggyback block of PrepareBlock messages in some view is equal to the trigger message block from the previous view, and
all PrepareBlock messages have a lower piggyback block than proposed block.

Ingredient one: All blocks that reach prepare stage in some view must have a PrepareBlock message in the global message buffer in that view.

We prove the first ingredient by case analysis on blocks being in prepare stage in some view: we must prove the existence of a global PrepareBlock message from the existence of a global PrepareVote and PrepareQC message respectively.

Lemma prepare_means_PrepareVote_PrepareQC_exists_global : 
  forall tr i, protocol_trace tr ->
    forall (b : block) (x : nat), prepare_stage_in_view_global tr i b x ->
      exists (msg1 : message),
        In msg1 (snd (tr i)) /\
        get_view msg1 = x /\
        get_block msg1 = b /\ 
        (get_message_type msg1 = PrepareVote \/
         get_message_type msg1 = PrepareQC).forall (tr : GTrace) (i : nat),
protocol_trace tr ->
forall (b : block) (x : nat),
prepare_stage_in_view_global tr i b x ->
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
Proof.forall (tr : GTrace) (i : nat),
protocol_trace tr ->
forall (b : block) (x : nat),
prepare_stage_in_view_global tr i b x ->
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
  intros tr i H_prot b x H_prepare.tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
H_prepare: prepare_stage_in_view_global tr i b x
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
  destruct H_prepare as [H_quorum | H_qc].tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
H_quorum: vote_quorum_in_view_global tr i b x
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
H_qc: PrepareQC_in_view_global tr i b x
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC) 
  -tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
H_quorum: vote_quorum_in_view_global tr i b x
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC) apply empty_has_no_two_thirds' in H_quorum.tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
H_quorum: exists n : node,
  In n
    (map get_sender
       (PrepareVote_about_block_in_view_global
          tr i b x))
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    destruct H_quorum as [n H_in].tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
H_in: In n
  (map get_sender
     (PrepareVote_about_block_in_view_global tr
        i b x))
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    apply in_map_iff in H_in.tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
H_in: exists x0 : message,
  get_sender x0 = n /\
  In x0
    (PrepareVote_about_block_in_view_global tr
       i b x)
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    destruct H_in as [msg [H_sender H_in]].tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
msg: message
H_sender: get_sender msg = n
H_in: In msg
  (PrepareVote_about_block_in_view_global tr i
     b x)
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    apply filter_In in H_in.tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
msg: message
H_sender: get_sender msg = n
H_in: In msg (snd (tr i)) /\
message_type_eqb (get_message_type msg)
  PrepareVote && block_eqb (get_block msg) b &&
(get_view msg =? x) = true
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC) 
    destruct H_in as [H_in H_typeblockview].tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
msg: message
H_sender: get_sender msg = n
H_in: In msg (snd (tr i))
H_typeblockview: message_type_eqb
  (get_message_type msg) PrepareVote &&
block_eqb (get_block msg) b &&
(get_view msg =? x) = true
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    apply andb_true_iff in H_typeblockview.tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
msg: message
H_sender: get_sender msg = n
H_in: In msg (snd (tr i))
H_typeblockview: message_type_eqb
  (get_message_type msg) PrepareVote &&
block_eqb (get_block msg) b = true /\
(get_view msg =? x) = true
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    destruct H_typeblockview as [H_typeblock H_view].tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
msg: message
H_sender: get_sender msg = n
H_in: In msg (snd (tr i))
H_typeblock: message_type_eqb (get_message_type msg)
  PrepareVote &&
block_eqb (get_block msg) b = true
H_view: (get_view msg =? x) = true
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    apply andb_prop in H_typeblock.tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
msg: message
H_sender: get_sender msg = n
H_in: In msg (snd (tr i))
H_typeblock: message_type_eqb (get_message_type msg)
  PrepareVote = true /\
block_eqb (get_block msg) b = true
H_view: (get_view msg =? x) = true
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC) 
    destruct H_typeblock as [H_type H_block].tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
msg: message
H_sender: get_sender msg = n
H_in: In msg (snd (tr i))
H_type: message_type_eqb (get_message_type msg)
  PrepareVote = true
H_block: block_eqb (get_block msg) b = true
H_view: (get_view msg =? x) = true
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    apply message_type_eqb_correct in H_type.tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
msg: message
H_sender: get_sender msg = n
H_in: In msg (snd (tr i))
H_type: get_message_type msg = PrepareVote
H_block: block_eqb (get_block msg) b = true
H_view: (get_view msg =? x) = true
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    apply Nat.eqb_eq in H_view.tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
msg: message
H_sender: get_sender msg = n
H_in: In msg (snd (tr i))
H_type: get_message_type msg = PrepareVote
H_block: block_eqb (get_block msg) b = true
H_view: get_view msg = x
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    apply block_eqb_correct in H_block.tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
n: node
msg: message
H_sender: get_sender msg = n
H_in: In msg (snd (tr i))
H_type: get_message_type msg = PrepareVote
H_block: get_block msg = b
H_view: get_view msg = x
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    exists msg; repeat split; try tauto.
  -tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
H_qc: PrepareQC_in_view_global tr i b x
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC) destruct H_qc as [msg H_qc].tr: GTrace
i: nat
H_prot: protocol_trace tr
b: block
x: nat
msg: message
H_qc: In msg (snd (tr i)) /\
get_view msg = x /\
get_block msg = b /\
get_message_type msg = PrepareQC
exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = x /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
    exists msg; repeat split; try tauto.
Qed.

We use the above fact to break down the proof that all prepare stage blocks must have a PrepareBlock message. Taking the left disjunct of prepare_stage_in_view_global, we first show that if a PrepareVote message for a block exists in the global message buffer, then a PrepareBlock message must exist for that block in the same view. This lemma belongs to a class of lemmas that we prove using the same proof pattern: by first showing the local version using induction on protocol traces, and then strengthening and weakening the premise and conclusion respectively to obtain the global version.

Lemma PrepareVote_sent_means_PrepareBlock_processed_local : 
  forall tr i n msg1, protocol_trace tr ->
    In n participants -> 
    In msg1 (out_messages (fst (tr i) n)) ->
    get_message_type msg1 = PrepareVote -> 
    exists (msg2 : message), 
      get_message_type msg2 = PrepareBlock /\
      get_view msg1 = get_view msg2 /\
      get_block msg1 = get_block msg2 /\ 
      In msg2 (counting_messages (fst (tr i) n)).forall (tr : GTrace) (i : nat) (n : node)
  (msg1 : message),
protocol_trace tr ->
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr i) n))  
Proof.forall (tr : GTrace) (i : nat) (n : node)
  (msg1 : message),
protocol_trace tr ->
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr i) n))
  intros tr i n msg1 H_prot H_part H_sent1 H_type1.tr: GTrace
i: nat
n: node
msg1: message
H_prot: protocol_trace tr
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr i) n))
H_type1: get_message_type msg1 = PrepareVote
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr i) n))
  induction i as [|i IH_prot].tr: GTrace
n: node
msg1: message
H_prot: protocol_trace tr
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr 0) n))
H_type1: get_message_type msg1 = PrepareVote
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr 0) n))
tr: GTrace
i: nat
n: node
msg1: message
H_prot: protocol_trace tr
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_type1: get_message_type msg1 = PrepareVote
IH_prot: In msg1 (out_messages (fst (tr i) n)) ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr i) n))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) 
  -tr: GTrace
n: node
msg1: message
H_prot: protocol_trace tr
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr 0) n))
H_type1: get_message_type msg1 = PrepareVote
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr 0) n)) destruct H_prot as [H_init _];
      rewrite H_init in H_sent1;
      inversion H_sent1. 
  -tr: GTrace
i: nat
n: node
msg1: message
H_prot: protocol_trace tr
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_type1: get_message_type msg1 = PrepareVote
IH_prot: In msg1 (out_messages (fst (tr i) n)) ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr i) n))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) destruct (In_dec message_eq_dec msg1 (out_messages (fst (tr i) n))) as [H_old | H_new].tr: GTrace
i: nat
n: node
msg1: message
H_prot: protocol_trace tr
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_type1: get_message_type msg1 = PrepareVote
IH_prot: In msg1 (out_messages (fst (tr i) n)) ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr i) n))
H_old: In msg1 (out_messages (fst (tr i) n))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_prot: protocol_trace tr
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_type1: get_message_type msg1 = PrepareVote
IH_prot: In msg1 (out_messages (fst (tr i) n)) ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr i) n))
H_new: ~ In msg1 (out_messages (fst (tr i) n))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
    +tr: GTrace
i: nat
n: node
msg1: message
H_prot: protocol_trace tr
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_type1: get_message_type msg1 = PrepareVote
IH_prot: In msg1 (out_messages (fst (tr i) n)) ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr i) n))
H_old: In msg1 (out_messages (fst (tr i) n))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) spec IH_prot.tr: GTrace
i: nat
n: node
msg1: message
H_prot: protocol_trace tr
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_type1: get_message_type msg1 = PrepareVote
IH_prot: In msg1 (out_messages (fst (tr i) n)) ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr i) n))
H_old: In msg1 (out_messages (fst (tr i) n))
In msg1 (out_messages (fst (tr i) n))
tr: GTrace
i: nat
n: node
msg1: message
H_prot: protocol_trace tr
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_type1: get_message_type msg1 = PrepareVote
H_old: In msg1 (out_messages (fst (tr i) n))
IH_prot: exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr i) n))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
      assumption.tr: GTrace
i: nat
n: node
msg1: message
H_prot: protocol_trace tr
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_type1: get_message_type msg1 = PrepareVote
H_old: In msg1 (out_messages (fst (tr i) n))
IH_prot: exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr i) n))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
      destruct IH_prot as [msg2 IH_prot];
        exists msg2; repeat split; try tauto.tr: GTrace
i: nat
n: node
msg1: message
H_prot: protocol_trace tr
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_type1: get_message_type msg1 = PrepareVote
H_old: In msg1 (out_messages (fst (tr i) n))
msg2: message
IH_prot: get_message_type msg2 = PrepareBlock /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2 (counting_messages (fst (tr i) n))
In msg2 (counting_messages (fst (tr (S i)) n))
      now apply counting_messages_monotonic.
    +tr: GTrace
i: nat
n: node
msg1: message
H_prot: protocol_trace tr
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_type1: get_message_type msg1 = PrepareVote
IH_prot: In msg1 (out_messages (fst (tr i) n)) ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr i) n))
H_new: ~ In msg1 (out_messages (fst (tr i) n))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) clear IH_prot.tr: GTrace
i: nat
n: node
msg1: message
H_prot: protocol_trace tr
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) 
      assert (H_prot_copy := H_prot); 
        destruct H_prot as [_ H_prot];
        spec H_prot i;
        destruct H_prot as [[n0 [H_in0 [p0 [msg0 [lm0 [H_step H_deliver]]]]]] | H_timeout].tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
      * (* In the normal transition case *)tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        assert (n0 = n).tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
n0 = n
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H: n0 = n
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        apply out_message_change_tells_sender with tr i p0 msg0 lm0; try assumption.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
exists msg : message,
  In msg (out_messages (fst (tr (S i)) n)) /\
  ~ In msg (out_messages (fst (tr i) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H: n0 = n
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        exists msg1; tauto.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H: n0 = n
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) 
        subst.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
p0: NState_transition_type
msg0: message
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_step: get_transition p0 (fst (tr i) n) msg0
  (fst (tr (S i)) n) lm0
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        destruct p0;
          destruct H_step as [H_update [H_out H_rest]];
          rewrite H_update in H_sent1;
        try easy;
        try (apply make_PrepareBlocks_message_type in H_sent1;
         rewrite H_sent1 in H_type1;
         try destruct H_type1 as [H_type1 | H_type1]; discriminate);
        simpl in H_sent1;
        repeat destruct H_sent1 as [H_sent1 | H_sent1];
        try (rewrite <- H_sent1 in H_type1; easy);
        try (subst; rewrite H_type1 in H_rest; easy);
        try contradiction;
        (* In the three remaining cases that send PrepareVote messages, *) 
        apply in_app_iff in H_sent1;
          destruct H_sent1 as [H_sent1 | H_sent1];
          try contradiction.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        
        assert (H_sent1_copy := H_sent1).tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: In msg1
  (pending_PrepareVote (fst (tr i) n)
     msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) 
        apply pending_PrepareVote_correct in H_sent1_copy.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        apply in_map_iff in H_sent1.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: exists x : message,
  make_PrepareVote (fst (tr i) n) msg0 x =
  msg1 /\
  In x
    (filter
       (fun msg : message =>
        (get_view msg =? get_view msg0) &&
        negb
          (exists_same_height_blockb
             (fst (tr i) n) 
             (get_block msg)) &&
        parent_ofb (get_block msg)
          (get_block msg0) &&
        message_type_eqb
          (get_message_type msg)
          PrepareBlock)
       (counting_messages (fst (tr i) n)))
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        destruct H_sent1 as [msg' [H_eq' H_in']].tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_in': In msg'
  (filter
     (fun msg : message =>
      (get_view msg =? get_view msg0) &&
      negb
        (exists_same_height_blockb
           (fst (tr i) n) 
           (get_block msg)) &&
      parent_ofb (get_block msg)
        (get_block msg0) &&
      message_type_eqb (get_message_type msg)
        PrepareBlock)
     (counting_messages (fst (tr i) n)))
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) 
        apply filter_In in H_in'.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_in': In msg' (counting_messages (fst (tr i) n)) /\
(get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        destruct H_in' as [H_received' H_rest'].tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        exists msg'; repeat split.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_message_type msg' = PrepareBlock
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg1 = get_view msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) 
        apply message_type_eqb_correct.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
message_type_eqb (get_message_type msg') PrepareBlock =
true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg1 = get_view msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) apply andb_prop in H_rest'.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) =
true /\
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
message_type_eqb (get_message_type msg') PrepareBlock =
true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg1 = get_view msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) tauto.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg1 = get_view msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        unfold view_valid in H_rest.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg1 = get_view msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        symmetry.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg' = get_view msg1
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) rewrite <- H_eq'; simpl.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg' = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        replace (node_view (fst (tr i) n)) with (get_view msg0).tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg' = get_view msg0
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        apply Nat.eqb_eq.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
(get_view msg' =? get_view msg0) = true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) apply andb_prop in H_rest'.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) =
true /\
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
(get_view msg' =? get_view msg0) = true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        destruct H_rest' as [H_rest' _].tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) =
true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
(get_view msg' =? get_view msg0) = true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        apply andb_prop in H_rest'.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) = true /\
parent_ofb (get_block msg') (get_block msg0) =
true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
(get_view msg' =? get_view msg0) = true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        destruct H_rest' as [H_rest' _].tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
(get_view msg' =? get_view msg0) = true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        apply andb_prop in H_rest'.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) = true /\
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
(get_view msg' =? get_view msg0) = true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        tauto.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) symmetry; tauto.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        rewrite <- H_eq'.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block (make_PrepareVote (fst (tr i) n) msg0 msg') =
get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) simpl.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg' = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) reflexivity.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        apply counting_messages_monotonic; try tauto.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        
        assert (H_sent1_copy := H_sent1).tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: In msg1
  (pending_PrepareVote (fst (tr i) n)
     msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) 
        apply pending_PrepareVote_correct in H_sent1_copy.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        apply in_map_iff in H_sent1.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: exists x : message,
  make_PrepareVote (fst (tr i) n) msg0 x =
  msg1 /\
  In x
    (filter
       (fun msg : message =>
        (get_view msg =? get_view msg0) &&
        negb
          (exists_same_height_blockb
             (fst (tr i) n) 
             (get_block msg)) &&
        parent_ofb (get_block msg)
          (get_block msg0) &&
        message_type_eqb
          (get_message_type msg)
          PrepareBlock)
       (counting_messages (fst (tr i) n)))
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        destruct H_sent1 as [msg' [H_eq' H_in']].tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_in': In msg'
  (filter
     (fun msg : message =>
      (get_view msg =? get_view msg0) &&
      negb
        (exists_same_height_blockb
           (fst (tr i) n) 
           (get_block msg)) &&
      parent_ofb (get_block msg)
        (get_block msg0) &&
      message_type_eqb (get_message_type msg)
        PrepareBlock)
     (counting_messages (fst (tr i) n)))
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) 
        apply filter_In in H_in'.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_in': In msg' (counting_messages (fst (tr i) n)) /\
(get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        destruct H_in' as [H_received' H_rest'].tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        exists msg'; repeat split.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_message_type msg' = PrepareBlock
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg1 = get_view msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) 
        apply message_type_eqb_correct.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
message_type_eqb (get_message_type msg') PrepareBlock =
true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg1 = get_view msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) apply andb_prop in H_rest'.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) =
true /\
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
message_type_eqb (get_message_type msg') PrepareBlock =
true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg1 = get_view msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) tauto.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg1 = get_view msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        unfold view_valid in H_rest.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg1 = get_view msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        symmetry.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg' = get_view msg1
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) rewrite <- H_eq'; simpl.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg' = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        replace (node_view (fst (tr i) n)) with (get_view msg0).tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg' = get_view msg0
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        apply Nat.eqb_eq.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
(get_view msg' =? get_view msg0) = true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) apply andb_prop in H_rest'.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) =
true /\
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
(get_view msg' =? get_view msg0) = true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        destruct H_rest' as [H_rest' _].tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) =
true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
(get_view msg' =? get_view msg0) = true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        apply andb_prop in H_rest'.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) = true /\
parent_ofb (get_block msg') (get_block msg0) =
true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
(get_view msg' =? get_view msg0) = true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        destruct H_rest' as [H_rest' _].tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
(get_view msg' =? get_view msg0) = true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        apply andb_prop in H_rest'.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) = true /\
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
(get_view msg' =? get_view msg0) = true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        tauto.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) symmetry; tauto.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        rewrite <- H_eq'.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block (make_PrepareVote (fst (tr i) n) msg0 msg') =
get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) simpl.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg' = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) reflexivity.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (pending_PrepareVote 
        (fst (tr i) n) msg0)) msg0
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~ last_block (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        apply counting_messages_monotonic; try tauto.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))

        assert (H_sent1_copy := H_sent1).tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: In msg1
  (pending_PrepareVote (fst (tr i) n)
     msg0)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) 
        apply pending_PrepareVote_correct in H_sent1_copy.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: In msg1
  (pending_PrepareVote (fst (tr i) n) msg0)
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        apply in_map_iff in H_sent1.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0: message
H_sent1: exists x : message,
  make_PrepareVote (fst (tr i) n) msg0 x =
  msg1 /\
  In x
    (filter
       (fun msg : message =>
        (get_view msg =? get_view msg0) &&
        negb
          (exists_same_height_blockb
             (fst (tr i) n) 
             (get_block msg)) &&
        parent_ofb (get_block msg)
          (get_block msg0) &&
        message_type_eqb
          (get_message_type msg)
          PrepareBlock)
       (counting_messages (fst (tr i) n)))
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        destruct H_sent1 as [msg' [H_eq' H_in']].tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_in': In msg'
  (filter
     (fun msg : message =>
      (get_view msg =? get_view msg0) &&
      negb
        (exists_same_height_blockb
           (fst (tr i) n) 
           (get_block msg)) &&
      parent_ofb (get_block msg)
        (get_block msg0) &&
      message_type_eqb (get_message_type msg)
        PrepareBlock)
     (counting_messages (fst (tr i) n)))
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) 
        apply filter_In in H_in'.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_in': In msg' (counting_messages (fst (tr i) n)) /\
(get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        destruct H_in' as [H_received' H_rest'].tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
        exists msg'; repeat split.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_message_type msg' = PrepareBlock
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg1 = get_view msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n)) 
        apply message_type_eqb_correct.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
message_type_eqb (get_message_type msg') PrepareBlock =
true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg1 = get_view msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n)) apply andb_prop in H_rest'.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) =
true /\
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
message_type_eqb (get_message_type msg') PrepareBlock =
true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg1 = get_view msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n)) tauto.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg1 = get_view msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
        unfold view_valid in H_rest.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
node_view (fst (tr i) n) = get_view msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg1 = get_view msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
        symmetry.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
node_view (fst (tr i) n) = get_view msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg' = get_view msg1
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n)) rewrite <- H_eq'; simpl.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
node_view (fst (tr i) n) = get_view msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg' = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
        replace (node_view (fst (tr i) n)) with (get_view msg0).tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
node_view (fst (tr i) n) = get_view msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg' = get_view msg0
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
node_view (fst (tr i) n) = get_view msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
        apply Nat.eqb_eq.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
node_view (fst (tr i) n) = get_view msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
(get_view msg' =? get_view msg0) = true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
node_view (fst (tr i) n) = get_view msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n)) apply andb_prop in H_rest'.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) =
true /\
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
node_view (fst (tr i) n) = get_view msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
(get_view msg' =? get_view msg0) = true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
node_view (fst (tr i) n) = get_view msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
        destruct H_rest' as [H_rest' _].tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) =
true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
node_view (fst (tr i) n) = get_view msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
(get_view msg' =? get_view msg0) = true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
node_view (fst (tr i) n) = get_view msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
        apply andb_prop in H_rest'.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) = true /\
parent_ofb (get_block msg') (get_block msg0) =
true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
node_view (fst (tr i) n) = get_view msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
(get_view msg' =? get_view msg0) = true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
node_view (fst (tr i) n) = get_view msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
        destruct H_rest' as [H_rest' _].tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
node_view (fst (tr i) n) = get_view msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
(get_view msg' =? get_view msg0) = true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
node_view (fst (tr i) n) = get_view msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
        apply andb_prop in H_rest'.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) = true /\
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
node_view (fst (tr i) n) = get_view msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
(get_view msg' =? get_view msg0) = true
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
node_view (fst (tr i) n) = get_view msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
        tauto.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
node_view (fst (tr i) n) = get_view msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_view msg0 = node_view (fst (tr i) n)
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n)) symmetry; tauto.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg1 = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
        rewrite <- H_eq'.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block (make_PrepareVote (fst (tr i) n) msg0 msg') =
get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n)) simpl.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
get_block msg' = get_block msg'
tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n)) reflexivity.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
msg0, msg': message
H_eq': make_PrepareVote (fst (tr i) n) msg0 msg' =
msg1
H_received': In msg'
  (counting_messages (fst (tr i) n))
H_rest': (get_view msg' =? get_view msg0) &&
negb
  (exists_same_height_blockb 
     (fst (tr i) n) (get_block msg')) &&
parent_ofb (get_block msg') (get_block msg0) &&
message_type_eqb (get_message_type msg')
  PrepareBlock = true
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural (process (fst (tr i) n) msg0)
  (pending_PrepareVote (fst (tr i) n) msg0)
H_out: lm0 = pending_PrepareVote (fst (tr i) n) msg0
H_rest: received (fst (tr i) n) msg0 /\
~ honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareBlock /\
view_valid (fst (tr i) n) msg0 /\
exists_same_height_block 
  (fst (tr i) n) (get_block msg0)
H_sent1_copy: get_message_type msg1 = PrepareVote /\
get_sender msg1 =
node_id (fst (tr i) n) /\
get_view msg1 =
node_view (fst (tr i) n)
In msg' (counting_messages (fst (tr (S i)) n))
        apply counting_messages_monotonic; try tauto.
        * (* In the timeout case *)tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) 
          rewrite H_timeout in H_sent1.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
H_sent1: In msg1
  (out_messages
     (fst
        (fun n : node =>
         if is_member n participants
         then flip_timeout (fst (tr i) n)
         else fst (tr i) n, 
         snd (tr i)) n))
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n)) 
          simpl in H_sent1.tr: GTrace
i: nat
n: node
msg1: message
H_part: In n participants
H_sent1: In msg1
  (out_messages
     (if is_member n participants
      then flip_timeout (fst (tr i) n)
      else fst (tr i) n))
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
          apply is_member_correct in H_part.tr: GTrace
i: nat
n: node
msg1: message
H_part: is_member n participants = true
H_sent1: In msg1
  (out_messages
     (if is_member n participants
      then flip_timeout (fst (tr i) n)
      else fst (tr i) n))
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
          rewrite H_part in H_sent1.tr: GTrace
i: nat
n: node
msg1: message
H_part: is_member n participants = true
H_sent1: In msg1
  (out_messages
     (flip_timeout (fst (tr i) n)))
H_type1: get_message_type msg1 = PrepareVote
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n))
          contradiction.
Qed.

Lemma PrepareVote_sent_means_PrepareBlock_sent_global : 
  forall tr i msg1, protocol_trace tr ->
    In msg1 (snd (tr i)) ->
    get_message_type msg1 = PrepareVote -> 
    exists (msg2 : message), 
      get_message_type msg2 = PrepareBlock /\
      get_view msg1 = get_view msg2 /\
      get_block msg1 = get_block msg2 /\ 
      In msg2 (snd (tr i)).forall (tr : GTrace) (i : nat) (msg1 : message),
protocol_trace tr ->
In msg1 (snd (tr i)) ->
get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))  
Proof.forall (tr : GTrace) (i : nat) (msg1 : message),
protocol_trace tr ->
In msg1 (snd (tr i)) ->
get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  intros tr i msg1 H_prot H_sent1 H_type1.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  assert (H_useful := PrepareVote_sent_means_PrepareBlock_processed_local).tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: forall (tr : GTrace) (i : nat) 
  (n : node) (msg1 : message),
protocol_trace tr ->
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  spec H_useful tr i (get_sender msg1) msg1 H_prot.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: In (get_sender msg1) participants ->
In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages
       (fst (tr i) (get_sender msg1)))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  spec H_useful.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: In (get_sender msg1) participants ->
In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages
       (fst (tr i) (get_sender msg1)))
In (get_sender msg1) participants
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages
       (fst (tr i) (get_sender msg1)))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  apply participation_rights_global with tr i; try assumption.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages
       (fst (tr i) (get_sender msg1)))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  spec H_useful.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages
       (fst (tr i) (get_sender msg1)))
In msg1 (out_messages (fst (tr i) (get_sender msg1)))
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages
       (fst (tr i) (get_sender msg1)))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i)) 
  apply global_local_out_if; try assumption.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages
       (fst (tr i) (get_sender msg1)))
In (get_sender msg1) participants
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages
       (fst (tr i) (get_sender msg1)))
In msg1
  (filter
     (fun msg : message =>
      node_eqb (get_sender msg) (get_sender msg1))
     (snd (tr i)))
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages
       (fst (tr i) (get_sender msg1)))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  apply participation_rights_global with tr i; try assumption.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages
       (fst (tr i) (get_sender msg1)))
In msg1
  (filter
     (fun msg : message =>
      node_eqb (get_sender msg) (get_sender msg1))
     (snd (tr i)))
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages
       (fst (tr i) (get_sender msg1)))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  apply filter_In.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages
       (fst (tr i) (get_sender msg1)))
In msg1 (snd (tr i)) /\
node_eqb (get_sender msg1) (get_sender msg1) = true
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages
       (fst (tr i) (get_sender msg1)))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i)) split.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages
       (fst (tr i) (get_sender msg1)))
In msg1 (snd (tr i))
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages
       (fst (tr i) (get_sender msg1)))
node_eqb (get_sender msg1) (get_sender msg1) = true
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages
       (fst (tr i) (get_sender msg1)))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i)) assumption.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages
       (fst (tr i) (get_sender msg1)))
node_eqb (get_sender msg1) (get_sender msg1) = true
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages
       (fst (tr i) (get_sender msg1)))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i)) apply node_eqb_correct.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages
       (fst (tr i) (get_sender msg1)))
get_sender msg1 = get_sender msg1
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages
       (fst (tr i) (get_sender msg1)))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  reflexivity.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages
       (fst (tr i) (get_sender msg1)))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  spec H_useful H_type1.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
H_useful: exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages
       (fst (tr i) (get_sender msg1)))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  destruct H_useful as [msg2 H_rest].tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
msg2: message
H_rest: get_message_type msg2 = PrepareBlock /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2
  (counting_messages
     (fst (tr i) (get_sender msg1)))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  exists msg2; repeat split; try tauto.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
msg2: message
H_rest: get_message_type msg2 = PrepareBlock /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2
  (counting_messages
     (fst (tr i) (get_sender msg1)))
In msg2 (snd (tr i))
  apply processed_means_sent_global with (get_sender msg1); try tauto.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareVote
msg2: message
H_rest: get_message_type msg2 = PrepareBlock /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2
  (counting_messages
     (fst (tr i) (get_sender msg1)))
In (get_sender msg1) participants
  apply participation_rights_global with tr i; try assumption.
Qed.

The right disjunct states that if a PrepareQC message for a block exists in the global message buffer, then a PrepareBlock message must exist for that block in the same view.

However, the proof structure here differs due to the following statement being untrue.

Definition PrepareQC_sent_means_exists_PrepareBlock_processed_local :=
  forall tr i n msg1, protocol_trace tr ->
    In n participants ->
    In msg1 (out_messages (fst (tr i) n)) -> 
    get_message_type msg1 = PrepareQC -> 
    exists (msg2 : message), 
      get_message_type msg2 = PrepareBlock /\
      get_view msg1 = get_view msg2 /\
      get_block msg1 = get_block msg2 /\
      In msg2 (counting_messages (fst (tr i) n)).

The reason why this is untrue is in the case of sending PrepareQC messages alongside ViewChangeQC messages - it is then no longer the case that the sender of the PrepareQC message has personally seen a PrepareBlock for that block, because it could have reached quorum votes independently of its participation.

Instead, we prove this by reverting back to global reasoning.

Lemma PrepareQC_sent_means_exists_PrepareVote_processed_local : 
  forall tr i n msg1, protocol_trace tr ->
    In n participants ->
    In msg1 (out_messages (fst (tr i) n)) -> 
    get_message_type msg1 = PrepareQC -> 
    exists (n' : node) (msg2 : message),
      In n' participants /\ 
      get_message_type msg2 = PrepareVote /\
      get_view msg1 = get_view msg2 /\
      get_block msg1 = get_block msg2 /\
      In msg2 (counting_messages (fst (tr i) n')).forall (tr : GTrace) (i : nat) (n : node)
  (msg1 : message),
protocol_trace tr ->
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr i) n'))  
Proof.forall (tr : GTrace) (i : nat) (n : node)
  (msg1 : message),
protocol_trace tr ->
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr i) n'))
  intros tr i n msg1 H_prot H_part H_sent1 H_type1.tr: GTrace
i: nat
n: node
msg1: message
H_prot: protocol_trace tr
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr i) n))
H_type1: get_message_type msg1 = PrepareQC
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr i) n'))
  generalize dependent n.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_type1: get_message_type msg1 = PrepareQC
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr i) n'))
  generalize dependent msg1.tr: GTrace
i: nat
H_prot: protocol_trace tr
forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr i) n')) 
  induction i as [|i IH_prot]; intros.tr: GTrace
H_prot: protocol_trace tr
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr 0) n))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr 0) n'))
tr: GTrace
i: nat
H_prot: protocol_trace tr
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) 
  -tr: GTrace
H_prot: protocol_trace tr
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr 0) n))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr 0) n')) destruct H_prot as [H_init _];
      rewrite H_init in H_sent1;
      inversion H_sent1. 
  -tr: GTrace
i: nat
H_prot: protocol_trace tr
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) destruct (In_dec message_eq_dec msg1 (out_messages (fst (tr i) n))) as [H_old | H_new].tr: GTrace
i: nat
H_prot: protocol_trace tr
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_old: In msg1 (out_messages (fst (tr i) n))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
tr: GTrace
i: nat
H_prot: protocol_trace tr
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_new: ~ In msg1 (out_messages (fst (tr i) n))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
    +tr: GTrace
i: nat
H_prot: protocol_trace tr
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_old: In msg1 (out_messages (fst (tr i) n))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) spec IH_prot msg1 H_type1 n H_part H_old.tr: GTrace
i: nat
H_prot: protocol_trace tr
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_old: In msg1 (out_messages (fst (tr i) n))
IH_prot: exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) 
      destruct IH_prot as [n' [msg2 IH_prot]];
        exists n', msg2; repeat split; try tauto.tr: GTrace
i: nat
H_prot: protocol_trace tr
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_old: In msg1 (out_messages (fst (tr i) n))
n': node
msg2: message
IH_prot: In n' participants /\
get_message_type msg2 = PrepareVote /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2 (counting_messages (fst (tr i) n'))
In msg2 (counting_messages (fst (tr (S i)) n'))
      now apply counting_messages_monotonic.
    +tr: GTrace
i: nat
H_prot: protocol_trace tr
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_new: ~ In msg1 (out_messages (fst (tr i) n))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) assert (H_prot_copy := H_prot); 
        destruct H_prot as [_ H_prot];
        spec H_prot i;
        destruct H_prot as [[n0 [H_in0 [p0 [msg0 [lm0 [H_step H_deliver]]]]]] | H_timeout].tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
      * (* In the normal transition case *)tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        assert (n0 = n).tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
n0 = n
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H: n0 = n
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        apply out_message_change_tells_sender with tr i p0 msg0 lm0; try assumption.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
exists msg : message,
  In msg (out_messages (fst (tr (S i)) n)) /\
  ~ In msg (out_messages (fst (tr i) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H: n0 = n
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        exists msg1; tauto.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H: n0 = n
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) 
        subst.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
p0: NState_transition_type
msg0: message
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_step: get_transition p0 (fst (tr i) n) msg0
  (fst (tr (S i)) n) lm0
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) 
        destruct p0;
          destruct H_step as [H_update [H_out H_rest]];
          rewrite H_update in H_sent1;
        try easy;
        try (apply make_PrepareBlocks_message_type in H_sent1;
         rewrite H_sent1 in H_type1; try destruct H_type1 as [H_type1 | H_type1];
         discriminate);
        try apply in_app_iff in H_sent1; 
        repeat destruct H_sent1 as [H_sent1 | H_sent1];
        try (rewrite <- H_sent1 in H_type1; easy);
        try (subst; rewrite H_type1 in H_rest; easy);
        try contradiction;
        try (apply pending_PrepareVote_correct in H_sent1;
             rewrite H_type1 in H_sent1; easy).tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))

        (* In the case that PrepareQC is sent by the node itself *)
        assert (H_quorum : vote_quorum_in_view (process (fst (tr i) n) msg0)
             (get_view msg0) (get_block msg0)) by tauto.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_quorum: vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) 
        red in H_quorum.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_quorum: quorum
  (processed_PrepareVote_in_view_about_block
     (process (fst (tr i) n) msg0)
     (get_view msg0) (get_block msg0))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) unfold quorum in H_quorum.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_quorum: has_at_least_two_thirds
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (process (fst (tr i) n) msg0)
        (get_view msg0) (get_block msg0)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        apply empty_has_no_two_thirds' in H_quorum.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_quorum: exists n0 : node,
  In n0
    (map get_sender
       (processed_PrepareVote_in_view_about_block
          (process (fst (tr i) n) msg0)
          (get_view msg0) 
          (get_block msg0)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        destruct H_quorum as [n' H_sender'].tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
H_sender': In n'
  (map get_sender
     (processed_PrepareVote_in_view_about_block
        (process (fst (tr i) n) msg0)
        (get_view msg0) (get_block msg0)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        apply in_map_iff in H_sender'.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
H_sender': exists x : message,
  get_sender x = n' /\
  In x
    (processed_PrepareVote_in_view_about_block
       (process (fst (tr i) n) msg0)
       (get_view msg0) (get_block msg0))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) destruct H_sender' as [msg' [H_sender' H_sent']].tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (processed_PrepareVote_in_view_about_block
     (process (fst (tr i) n) msg0)
     (get_view msg0) (get_block msg0))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        exists n, msg'.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (processed_PrepareVote_in_view_about_block
     (process (fst (tr i) n) msg0)
     (get_view msg0) (get_block msg0))
In n participants /\
get_message_type msg' = PrepareVote /\
get_view msg1 = get_view msg' /\
get_block msg1 = get_block msg' /\
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) apply filter_In in H_sent'.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0)) /\
message_type_eqb (get_message_type msg')
  PrepareVote &&
block_eqb (get_block msg') (get_block msg0) &&
(get_view msg' =? get_view msg0) = true
In n participants /\
get_message_type msg' = PrepareVote /\
get_view msg1 = get_view msg' /\
get_block msg1 = get_block msg' /\
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        destruct H_sent' as [H_sent' H_rest'].tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_rest': message_type_eqb (get_message_type msg')
  PrepareVote &&
block_eqb (get_block msg') (get_block msg0) &&
(get_view msg' =? get_view msg0) = true
In n participants /\
get_message_type msg' = PrepareVote /\
get_view msg1 = get_view msg' /\
get_block msg1 = get_block msg' /\
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        apply andb_prop in H_rest'.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_rest': message_type_eqb (get_message_type msg')
  PrepareVote &&
block_eqb (get_block msg') (get_block msg0) =
true /\
(get_view msg' =? get_view msg0) = true
In n participants /\
get_message_type msg' = PrepareVote /\
get_view msg1 = get_view msg' /\
get_block msg1 = get_block msg' /\
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        destruct H_rest' as [H_rest' H_view'].tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_rest': message_type_eqb (get_message_type msg')
  PrepareVote &&
block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
In n participants /\
get_message_type msg' = PrepareVote /\
get_view msg1 = get_view msg' /\
get_block msg1 = get_block msg' /\
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        apply andb_prop in H_rest'.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_rest': message_type_eqb (get_message_type msg')
  PrepareVote = true /\
block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
In n participants /\
get_message_type msg' = PrepareVote /\
get_view msg1 = get_view msg' /\
get_block msg1 = get_block msg' /\
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        destruct H_rest' as [H_type' H_block'].tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
In n participants /\
get_message_type msg' = PrepareVote /\
get_view msg1 = get_view msg' /\
get_block msg1 = get_block msg' /\
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        repeat split.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
In n participants
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
get_message_type msg' = PrepareVote
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
get_view msg1 = get_view msg'
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
get_block msg1 = get_block msg'
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        assumption.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
get_message_type msg' = PrepareVote
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
get_view msg1 = get_view msg'
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
get_block msg1 = get_block msg'
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        apply message_type_eqb_correct.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
message_type_eqb (get_message_type msg') PrepareVote =
true
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
get_view msg1 = get_view msg'
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
get_block msg1 = get_block msg'
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) assumption.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
get_view msg1 = get_view msg'
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
get_block msg1 = get_block msg'
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        symmetry.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
get_view msg' = get_view msg1
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
get_block msg1 = get_block msg'
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) 
        rewrite <- H_sent1; simpl.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
get_view msg' = node_view (fst (tr i) n)
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
get_block msg1 = get_block msg'
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        unfold view_valid in H_rest.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
get_view msg' = node_view (fst (tr i) n)
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
get_block msg1 = get_block msg'
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        replace (node_view (fst (tr i) n)) with (get_view msg0) by easy.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
get_view msg' = get_view msg0
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
get_block msg1 = get_block msg'
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        apply Nat.eqb_eq.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
node_view (fst (tr i) n) = get_view msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
(get_view msg' =? get_view msg0) = true
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
get_block msg1 = get_block msg'
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) assumption.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
get_block msg1 = get_block msg'
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        symmetry.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
get_block msg' = get_block msg1
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) 
        rewrite <- H_sent1; simpl.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
get_block msg' = get_block msg0
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        apply block_eqb_correct.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
block_eqb (get_block msg') (get_block msg0) = true
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) assumption.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
In msg' (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        rewrite H_update.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
In msg'
  (counting_messages
     (process
        (record_plural (fst (tr i) n)
           (make_PrepareQC (fst (tr i) n) msg0
            :: pending_PrepareVote (fst (tr i) n) msg0))
        msg0))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) simpl.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: make_PrepareQC (fst (tr i) n) msg0 = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
n': node
msg': message
H_sender': get_sender msg' = n'
H_sent': In msg'
  (counting_messages
     (process (fst (tr i) n) msg0))
H_type': message_type_eqb (get_message_type msg')
  PrepareVote = true
H_block': block_eqb (get_block msg') (get_block msg0) =
true
H_view': (get_view msg' =? get_view msg0) = true
msg0 = msg' \/
In msg' (counting_messages (fst (tr i) n))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) easy.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))

        (* In the case that the PrepareQC is aggregated and from some other node *)        
        destruct (node_eq_dec (get_sender msg0) n).tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
e: get_sender msg0 = n
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) 
        **tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
e: get_sender msg0 = n
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) subst.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
           spec IH_prot {|
            get_message_type := PrepareQC;
            get_view := get_view msg0;
            get_sender := get_sender msg0;
            get_block := get_block (highest_ViewChange_message
              (process (fst (tr i) (get_sender msg0)) msg0));
            get_piggyback_block := GenesisBlock |}.tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC ->
forall n : node,
In n participants ->
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        spec IH_prot.tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC ->
forall n : node,
In n participants ->
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
get_message_type
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: forall n : node,
In n participants ->
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) simpl.tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC ->
forall n : node,
In n participants ->
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
PrepareQC = PrepareQC
tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: forall n : node,
In n participants ->
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) reflexivity.tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: forall n : node,
In n participants ->
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        spec IH_prot (get_sender msg0).tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: In (get_sender msg0) participants ->
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        spec IH_prot.tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: In (get_sender msg0) participants ->
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In (get_sender msg0) participants
tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) assumption.tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        spec IH_prot.tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) (get_sender msg0)))
tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        apply global_local_out_if; try assumption.tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (filter
     (fun msg : message =>
      node_eqb (get_sender msg) (get_sender msg0))
     (snd (tr i)))
tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        apply filter_In.tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} (snd (tr i)) /\
node_eqb
  (get_sender
     {|
       get_message_type := PrepareQC;
       get_view := get_view msg0;
       get_sender := get_sender msg0;
       get_block :=
         get_block
           (highest_ViewChange_message
              (process (fst (tr i) (get_sender msg0))
                 msg0));
       get_piggyback_block := GenesisBlock
     |}) (get_sender msg0) = true
tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) split.tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} (snd (tr i))
tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
node_eqb
  (get_sender
     {|
       get_message_type := PrepareQC;
       get_view := get_view msg0;
       get_sender := get_sender msg0;
       get_block :=
         get_block
           (highest_ViewChange_message
              (process (fst (tr i) (get_sender msg0))
                 msg0));
       get_piggyback_block := GenesisBlock
     |}) (get_sender msg0) = true
tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        apply delivered_means_sent_global with (get_sender msg0); try assumption;
          try tauto.tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
node_eqb
  (get_sender
     {|
       get_message_type := PrepareQC;
       get_view := get_view msg0;
       get_sender := get_sender msg0;
       get_block :=
         get_block
           (highest_ViewChange_message
              (process (fst (tr i) (get_sender msg0))
                 msg0));
       get_piggyback_block := GenesisBlock
     |}) (get_sender msg0) = true
tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) apply node_eqb_correct.tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
get_sender
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_sender msg0
tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) reflexivity.tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
IH_prot: exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process
                (fst (tr i)
                   (get_sender msg0)) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        destruct IH_prot as [n' [msg' [H_part' [H_type' [H_view' [H_block' H_processed]]]]]].tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view :=
        node_view (fst (tr i) (get_sender msg0));
      get_sender :=
        node_id (fst (tr i) (get_sender msg0));
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) (get_sender msg0))
                msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        exists n', msg'; repeat split; try tauto.tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
get_view
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
In msg' (counting_messages (fst (tr (S i)) n'))
        simpl.tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
node_view (fst (tr i) (get_sender msg0)) =
get_view msg'
tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
In msg' (counting_messages (fst (tr (S i)) n')) rewrite <- H_view'.tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
node_view (fst (tr i) (get_sender msg0)) =
get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
In msg' (counting_messages (fst (tr (S i)) n')) simpl.tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
node_view (fst (tr i) (get_sender msg0)) =
get_view msg0
tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
In msg' (counting_messages (fst (tr (S i)) n'))
        unfold view_valid in H_rest.tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
node_view (fst (tr i) (get_sender msg0)) =
get_view msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
node_view (fst (tr i) (get_sender msg0)) =
get_view msg0
tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
In msg' (counting_messages (fst (tr (S i)) n')) tauto.tr: GTrace
i: nat
msg0: message
H_new: ~
In
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages (fst (tr i) (get_sender msg0)))
H_part: In (get_sender msg0) participants
H_type1: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view :=
      node_view
        (fst (tr i) (get_sender msg0));
    get_sender :=
      node_id (fst (tr i) (get_sender msg0));
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
H_prot_copy: protocol_trace tr
H_rest: received (fst (tr i) (get_sender msg0)) msg0 /\
received (fst (tr i) (get_sender msg0))
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node
  (node_id (fst (tr i) (get_sender msg0))) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) (get_sender msg0))
  msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) (get_sender msg0))
     msg0)
  (node_view (fst (tr i) (get_sender msg0))) /\
is_block_proposer
  (node_id (fst (tr i) (get_sender msg0)))
  (S
     (node_view
        (fst (tr i) (get_sender msg0))))
H_update: fst (tr (S i)) (get_sender msg0) =
record_plural
  (increment_view
     (process
        (process
           (fst (tr i) (get_sender msg0))
           msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process
                    (fst 
                       (tr i)
                       (get_sender msg0))
                    msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i) (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0)) msg0)))
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg0))
  (fst (tr (S i)) (get_sender msg0))
  ({|
     get_message_type := PrepareQC;
     get_view :=
       node_view
         (fst (tr i) (get_sender msg0));
     get_sender :=
       node_id
         (fst (tr i) (get_sender msg0));
     get_block :=
       get_block
         (highest_ViewChange_message
            (process
               (fst (tr i)
                  (get_sender msg0)) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC
        (fst (tr i) (get_sender msg0))
        (highest_ViewChange_message
           (process
              (fst (tr i)
                 (get_sender msg0)) msg0))
      :: make_PrepareBlocks
           (increment_view
              (fst (tr i)
                 (get_sender msg0)))
           (highest_ViewChange_message
              (process
                 (fst (tr i)
                    (get_sender msg0))
                 msg0)))
H_in0: In (get_sender msg0) participants
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process
              (fst (tr i) (get_sender msg0))
              msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
In msg' (counting_messages (fst (tr (S i)) n'))
        apply counting_messages_monotonic; try assumption.
        **tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) spec IH_prot {|
             get_message_type := PrepareQC;
             get_view := get_view msg0;
             get_sender := get_sender msg0;
             get_block := get_block (highest_ViewChange_message (process (fst (tr i) n) msg0));
             get_piggyback_block := GenesisBlock |}.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC ->
forall n0 : node,
In n0 participants ->
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n0)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) 
        spec IH_prot.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC ->
forall n0 : node,
In n0 participants ->
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n0)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
get_message_type
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: forall n0 : node,
In n0 participants ->
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n0)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) simpl.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: get_message_type
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = PrepareQC ->
forall n0 : node,
In n0 participants ->
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n0)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
PrepareQC = PrepareQC
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: forall n0 : node,
In n0 participants ->
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n0)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) reflexivity.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: forall n0 : node,
In n0 participants ->
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) n0)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        spec IH_prot (get_sender msg0).tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In (get_sender msg0) participants ->
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        spec IH_prot.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In (get_sender msg0) participants ->
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In (get_sender msg0) participants
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        (* Participation rights *)
        apply participation_rights with tr n (S i);
          try assumption.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In (get_sender msg0) participants ->
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In msg0 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        rewrite H_update.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In (get_sender msg0) participants ->
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In msg0
  (counting_messages
     (record_plural
        (increment_view
           (process (process (fst (tr i) n) msg0)
              {|
                get_message_type := PrepareQC;
                get_view := get_view msg0;
                get_sender := get_sender msg0;
                get_block :=
                  get_block
                    (highest_ViewChange_message
                       (process (fst (tr i) n) msg0));
                get_piggyback_block := GenesisBlock
              |}))
        ({|
           get_message_type := PrepareQC;
           get_view := node_view (fst (tr i) n);
           get_sender := node_id (fst (tr i) n);
           get_block :=
             get_block
               (highest_ViewChange_message
                  (process (fst (tr i) n) msg0));
           get_piggyback_block := GenesisBlock
         |}
         :: make_ViewChangeQC 
              (fst (tr i) n)
              (highest_ViewChange_message
                 (process (fst (tr i) n) msg0))
            :: make_PrepareBlocks
                 (increment_view (fst (tr i) n))
                 (highest_ViewChange_message
                    (process (fst (tr i) n) msg0)))))
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) simpl.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In (get_sender msg0) participants ->
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
{|
  get_message_type := PrepareQC;
  get_view := get_view msg0;
  get_sender := get_sender msg0;
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg0 \/
msg0 = msg0 \/
In msg0 (counting_messages (fst (tr i) n))
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) tauto.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) 
        spec IH_prot.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} (out_messages (fst (tr i) (get_sender msg0)))
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        apply global_local_out_if; try assumption.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In (get_sender msg0) participants
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (filter
     (fun msg : message =>
      node_eqb (get_sender msg) (get_sender msg0))
     (snd (tr i)))
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        (* Participation rights *)
        apply participation_rights with tr n (S i);
          try assumption.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In msg0 (counting_messages (fst (tr (S i)) n))
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (filter
     (fun msg : message =>
      node_eqb (get_sender msg) (get_sender msg0))
     (snd (tr i)))
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        rewrite H_update.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In msg0
  (counting_messages
     (record_plural
        (increment_view
           (process (process (fst (tr i) n) msg0)
              {|
                get_message_type := PrepareQC;
                get_view := get_view msg0;
                get_sender := get_sender msg0;
                get_block :=
                  get_block
                    (highest_ViewChange_message
                       (process (fst (tr i) n) msg0));
                get_piggyback_block := GenesisBlock
              |}))
        ({|
           get_message_type := PrepareQC;
           get_view := node_view (fst (tr i) n);
           get_sender := node_id (fst (tr i) n);
           get_block :=
             get_block
               (highest_ViewChange_message
                  (process (fst (tr i) n) msg0));
           get_piggyback_block := GenesisBlock
         |}
         :: make_ViewChangeQC 
              (fst (tr i) n)
              (highest_ViewChange_message
                 (process (fst (tr i) n) msg0))
            :: make_PrepareBlocks
                 (increment_view (fst (tr i) n))
                 (highest_ViewChange_message
                    (process (fst (tr i) n) msg0)))))
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (filter
     (fun msg : message =>
      node_eqb (get_sender msg) (get_sender msg0))
     (snd (tr i)))
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) simpl.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
{|
  get_message_type := PrepareQC;
  get_view := get_view msg0;
  get_sender := get_sender msg0;
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg0 \/
msg0 = msg0 \/
In msg0 (counting_messages (fst (tr i) n))
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (filter
     (fun msg : message =>
      node_eqb (get_sender msg) (get_sender msg0))
     (snd (tr i)))
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) tauto.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (filter
     (fun msg : message =>
      node_eqb (get_sender msg) (get_sender msg0))
     (snd (tr i)))
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))  
        apply filter_In.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} (snd (tr i)) /\
node_eqb
  (get_sender
     {|
       get_message_type := PrepareQC;
       get_view := get_view msg0;
       get_sender := get_sender msg0;
       get_block :=
         get_block
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0));
       get_piggyback_block := GenesisBlock
     |}) (get_sender msg0) = true
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) split.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} (snd (tr i))
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
node_eqb
  (get_sender
     {|
       get_message_type := PrepareQC;
       get_view := get_view msg0;
       get_sender := get_sender msg0;
       get_block :=
         get_block
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0));
       get_piggyback_block := GenesisBlock
     |}) (get_sender msg0) = true
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        apply delivered_means_sent_global with n; try assumption; try tauto.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
node_eqb
  (get_sender
     {|
       get_message_type := PrepareQC;
       get_view := get_view msg0;
       get_sender := get_sender msg0;
       get_block :=
         get_block
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0));
       get_piggyback_block := GenesisBlock
     |}) (get_sender msg0) = true
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        apply node_eqb_correct.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
get_sender
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_sender msg0
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) simpl.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: In
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
  (out_messages
     (fst (tr i) (get_sender msg0))) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
get_sender msg0 = get_sender msg0
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) reflexivity.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
IH_prot: exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_view msg2 /\
  get_block
    {|
      get_message_type := PrepareQC;
      get_view := get_view msg0;
      get_sender := get_sender msg0;
      get_block :=
        get_block
          (highest_ViewChange_message
             (process (fst (tr i) n) msg0));
      get_piggyback_block := GenesisBlock
    |} = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        destruct IH_prot as [n' [msg' [H_part' [H_type' [H_view' [H_block' H_processed]]]]]].tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        exists n', msg'; repeat split; try tauto.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
get_view msg1 = get_view msg'
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
get_block msg1 = get_block msg'
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
In msg' (counting_messages (fst (tr (S i)) n'))
        rewrite <- H_view'.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
get_view msg1 =
get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |}
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
get_block msg1 = get_block msg'
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
In msg' (counting_messages (fst (tr (S i)) n')) simpl.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
get_view msg1 = get_view msg0
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
get_block msg1 = get_block msg'
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
In msg' (counting_messages (fst (tr (S i)) n'))
        rewrite <- H_sent1.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
get_view
  {|
    get_message_type := PrepareQC;
    get_view := node_view (fst (tr i) n);
    get_sender := node_id (fst (tr i) n);
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg0
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
get_block msg1 = get_block msg'
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
In msg' (counting_messages (fst (tr (S i)) n')) simpl.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
node_view (fst (tr i) n) = get_view msg0
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
get_block msg1 = get_block msg'
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
In msg' (counting_messages (fst (tr (S i)) n'))
        unfold view_valid in H_rest.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
node_view (fst (tr i) n) = get_view msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
node_view (fst (tr i) n) = get_view msg0
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
get_block msg1 = get_block msg'
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
In msg' (counting_messages (fst (tr (S i)) n')) tauto.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
get_block msg1 = get_block msg'
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
In msg' (counting_messages (fst (tr (S i)) n'))
        simpl in H_block'.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  (highest_ViewChange_message
     (process (fst (tr i) n) msg0)) =
get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
get_block msg1 = get_block msg'
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
In msg' (counting_messages (fst (tr (S i)) n'))
        rewrite <- H_sent1.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  (highest_ViewChange_message
     (process (fst (tr i) n) msg0)) =
get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
get_block
  {|
    get_message_type := PrepareQC;
    get_view := node_view (fst (tr i) n);
    get_sender := node_id (fst (tr i) n);
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
In msg' (counting_messages (fst (tr (S i)) n')) simpl.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  (highest_ViewChange_message
     (process (fst (tr i) n) msg0)) =
get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
get_block
  (highest_ViewChange_message
     (process (fst (tr i) n) msg0)) = 
get_block msg'
tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
In msg' (counting_messages (fst (tr (S i)) n'))
        assumption.tr: GTrace
i: nat
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
msg0: message
H_sent1: {|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|} = msg1
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
n0: get_sender msg0 <> n
n': node
msg': message
H_part': In n' participants
H_type': get_message_type msg' = PrepareVote
H_view': get_view
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_view msg'
H_block': get_block
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} = get_block msg'
H_processed: In msg'
  (counting_messages (fst (tr i) n'))
In msg' (counting_messages (fst (tr (S i)) n')) apply counting_messages_monotonic; try assumption.
      *tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
H_sent1: In msg1 (out_messages (fst (tr (S i)) n))
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n')) rewrite H_timeout in H_sent1.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
H_sent1: In msg1
  (out_messages
     (fst
        (fun n : node =>
         if is_member n participants
         then flip_timeout (fst (tr i) n)
         else fst (tr i) n, 
         snd (tr i)) n))
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        simpl in H_sent1.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: In n participants
H_sent1: In msg1
  (out_messages
     (if is_member n participants
      then flip_timeout (fst (tr i) n)
      else fst (tr i) n))
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        apply is_member_correct in H_part.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: is_member n participants = true
H_sent1: In msg1
  (out_messages
     (if is_member n participants
      then flip_timeout (fst (tr i) n)
      else fst (tr i) n))
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        rewrite H_part in H_sent1.tr: GTrace
i: nat
IH_prot: forall msg1 : message,
get_message_type msg1 = PrepareQC ->
forall n : node,
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
msg1: message
H_type1: get_message_type msg1 = PrepareQC
n: node
H_part: is_member n participants = true
H_sent1: In msg1
  (out_messages
     (flip_timeout (fst (tr i) n)))
H_new: ~ In msg1 (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (counting_messages (fst (tr (S i)) n'))
        contradiction.
Qed. 

Lemma PrepareQC_sent_means_PrepareVote_sent_global : 
  forall tr i msg1,
    protocol_trace tr ->
    In msg1 (snd (tr i)) -> 
    get_message_type msg1 = PrepareQC -> 
    exists (msg2 : message), 
      get_message_type msg2 = PrepareVote /\
      get_view msg1 = get_view msg2 /\
      get_block msg1 = get_block msg2 /\
      In msg2 (snd (tr i)).forall (tr : GTrace) (i : nat) (msg1 : message),
protocol_trace tr ->
In msg1 (snd (tr i)) ->
get_message_type msg1 = PrepareQC ->
exists msg2 : message,
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))  
Proof.forall (tr : GTrace) (i : nat) (msg1 : message),
protocol_trace tr ->
In msg1 (snd (tr i)) ->
get_message_type msg1 = PrepareQC ->
exists msg2 : message,
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  intros tr i msg1 H_prot H_sent1 H_type1.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
exists msg2 : message,
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  assert (H_useful := PrepareQC_sent_means_exists_PrepareVote_processed_local).tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: forall (tr : GTrace) (i : nat) 
  (n : node) (msg1 : message),
protocol_trace tr ->
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  spec H_useful tr i (get_sender msg1) msg1 H_prot.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In (get_sender msg1) participants ->
In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  spec H_useful.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In (get_sender msg1) participants ->
In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In (get_sender msg1) participants
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  apply participation_rights_global with tr i; try assumption.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  spec H_useful.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In msg1 (out_messages (fst (tr i) (get_sender msg1)))
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i)) 
  apply global_local_out_if; try assumption.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In (get_sender msg1) participants
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In msg1
  (filter
     (fun msg : message =>
      node_eqb (get_sender msg) (get_sender msg1))
     (snd (tr i)))
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  apply participation_rights_global with tr i; try assumption.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In msg1
  (filter
     (fun msg : message =>
      node_eqb (get_sender msg) (get_sender msg1))
     (snd (tr i)))
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  apply filter_In.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In msg1 (snd (tr i)) /\
node_eqb (get_sender msg1) (get_sender msg1) = true
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i)) split.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In msg1 (snd (tr i))
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
node_eqb (get_sender msg1) (get_sender msg1) = true
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i)) assumption.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
node_eqb (get_sender msg1) (get_sender msg1) = true
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i)) apply node_eqb_correct.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
get_sender msg1 = get_sender msg1
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  reflexivity.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  spec H_useful H_type1.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  destruct H_useful as [n' [msg2 H_rest]].tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
n': node
msg2: message
H_rest: In n' participants /\
get_message_type msg2 = PrepareVote /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2 (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  exists msg2; repeat split; try tauto.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
n': node
msg2: message
H_rest: In n' participants /\
get_message_type msg2 = PrepareVote /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2 (counting_messages (fst (tr i) n'))
In msg2 (snd (tr i))
  apply processed_means_sent_global with n'; try tauto.
Qed.   
  
Lemma PrepareQC_sent_means_PrepareBlock_sent_global : 
  forall tr i msg1,
    protocol_trace tr ->
    In msg1 (snd (tr i)) -> 
    get_message_type msg1 = PrepareQC -> 
    exists (msg2 : message), 
      get_message_type msg2 = PrepareBlock /\
      get_view msg1 = get_view msg2 /\
      get_block msg1 = get_block msg2 /\
      In msg2 (snd (tr i)).forall (tr : GTrace) (i : nat) (msg1 : message),
protocol_trace tr ->
In msg1 (snd (tr i)) ->
get_message_type msg1 = PrepareQC ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))  
Proof.forall (tr : GTrace) (i : nat) (msg1 : message),
protocol_trace tr ->
In msg1 (snd (tr i)) ->
get_message_type msg1 = PrepareQC ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  intros tr i msg1 H_prot H_sent1 H_type1.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  assert (H_useful := PrepareQC_sent_means_exists_PrepareVote_processed_local).tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: forall (tr : GTrace) (i : nat) 
  (n : node) (msg1 : message),
protocol_trace tr ->
In n participants ->
In msg1 (out_messages (fst (tr i) n)) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  spec H_useful tr i (get_sender msg1) msg1 H_prot.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In (get_sender msg1) participants ->
In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  spec H_useful.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In (get_sender msg1) participants ->
In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In (get_sender msg1) participants
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  apply participation_rights_global with tr i; try assumption.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  spec H_useful.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In msg1 (out_messages (fst (tr i) (get_sender msg1)))
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i)) 
  apply global_local_out_if; try assumption.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In (get_sender msg1) participants
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In msg1
  (filter
     (fun msg : message =>
      node_eqb (get_sender msg) (get_sender msg1))
     (snd (tr i)))
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  apply participation_rights_global with tr i; try assumption.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In msg1
  (filter
     (fun msg : message =>
      node_eqb (get_sender msg) (get_sender msg1))
     (snd (tr i)))
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  apply filter_In.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In msg1 (snd (tr i)) /\
node_eqb (get_sender msg1) (get_sender msg1) = true
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i)) split.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
In msg1 (snd (tr i))
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
node_eqb (get_sender msg1) (get_sender msg1) = true
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i)) assumption.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
node_eqb (get_sender msg1) (get_sender msg1) = true
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i)) apply node_eqb_correct.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: In msg1
  (out_messages
     (fst (tr i) (get_sender msg1))) ->
get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
get_sender msg1 = get_sender msg1
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  reflexivity.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: get_message_type msg1 = PrepareQC ->
exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  spec H_useful H_type1.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
H_useful: exists (n' : node) (msg2 : message),
  In n' participants /\
  get_message_type msg2 = PrepareVote /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2
    (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  destruct H_useful as [n' [msg2 H_rest]].tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
n': node
msg2: message
H_rest: In n' participants /\
get_message_type msg2 = PrepareVote /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2 (counting_messages (fst (tr i) n'))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  (* Now we have established that n' has sent a PrepareVote *) 
  assert (H_useful2 := PrepareVote_sent_means_PrepareBlock_sent_global).tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
n': node
msg2: message
H_rest: In n' participants /\
get_message_type msg2 = PrepareVote /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2 (counting_messages (fst (tr i) n'))
H_useful2: forall (tr : GTrace) (i : nat)
  (msg1 : message),
protocol_trace tr ->
In msg1 (snd (tr i)) ->
get_message_type msg1 = PrepareVote ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  spec H_useful2 tr i msg2 H_prot.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
n': node
msg2: message
H_rest: In n' participants /\
get_message_type msg2 = PrepareVote /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2 (counting_messages (fst (tr i) n'))
H_useful2: In msg2 (snd (tr i)) ->
get_message_type msg2 = PrepareVote ->
exists msg3 : message,
  get_message_type msg3 = PrepareBlock /\
  get_view msg2 = get_view msg3 /\
  get_block msg2 = get_block msg3 /\
  In msg3 (snd (tr i))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  spec H_useful2.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
n': node
msg2: message
H_rest: In n' participants /\
get_message_type msg2 = PrepareVote /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2 (counting_messages (fst (tr i) n'))
H_useful2: In msg2 (snd (tr i)) ->
get_message_type msg2 = PrepareVote ->
exists msg3 : message,
  get_message_type msg3 = PrepareBlock /\
  get_view msg2 = get_view msg3 /\
  get_block msg2 = get_block msg3 /\
  In msg3 (snd (tr i))
In msg2 (snd (tr i))
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
n': node
msg2: message
H_rest: In n' participants /\
get_message_type msg2 = PrepareVote /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2 (counting_messages (fst (tr i) n'))
H_useful2: get_message_type msg2 = PrepareVote ->
exists msg3 : message,
  get_message_type msg3 = PrepareBlock /\
  get_view msg2 = get_view msg3 /\
  get_block msg2 = get_block msg3 /\
  In msg3 (snd (tr i))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  apply processed_means_sent_global with n'; try tauto.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
n': node
msg2: message
H_rest: In n' participants /\
get_message_type msg2 = PrepareVote /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2 (counting_messages (fst (tr i) n'))
H_useful2: get_message_type msg2 = PrepareVote ->
exists msg3 : message,
  get_message_type msg3 = PrepareBlock /\
  get_view msg2 = get_view msg3 /\
  get_block msg2 = get_block msg3 /\
  In msg3 (snd (tr i))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  spec H_useful2.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
n': node
msg2: message
H_rest: In n' participants /\
get_message_type msg2 = PrepareVote /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2 (counting_messages (fst (tr i) n'))
H_useful2: get_message_type msg2 = PrepareVote ->
exists msg3 : message,
  get_message_type msg3 = PrepareBlock /\
  get_view msg2 = get_view msg3 /\
  get_block msg2 = get_block msg3 /\
  In msg3 (snd (tr i))
get_message_type msg2 = PrepareVote
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
n': node
msg2: message
H_rest: In n' participants /\
get_message_type msg2 = PrepareVote /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2 (counting_messages (fst (tr i) n'))
H_useful2: exists msg3 : message,
  get_message_type msg3 = PrepareBlock /\
  get_view msg2 = get_view msg3 /\
  get_block msg2 = get_block msg3 /\
  In msg3 (snd (tr i))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i)) tauto.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
n': node
msg2: message
H_rest: In n' participants /\
get_message_type msg2 = PrepareVote /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2 (counting_messages (fst (tr i) n'))
H_useful2: exists msg3 : message,
  get_message_type msg3 = PrepareBlock /\
  get_view msg2 = get_view msg3 /\
  get_block msg2 = get_block msg3 /\
  In msg3 (snd (tr i))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  destruct H_useful2 as [msg0 H_about0].tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
n': node
msg2: message
H_rest: In n' participants /\
get_message_type msg2 = PrepareVote /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2 (counting_messages (fst (tr i) n'))
msg0: message
H_about0: get_message_type msg0 = PrepareBlock /\
get_view msg2 = get_view msg0 /\
get_block msg2 = get_block msg0 /\
In msg0 (snd (tr i))
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
  exists msg0; repeat split; try tauto.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
n': node
msg2: message
H_rest: In n' participants /\
get_message_type msg2 = PrepareVote /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2 (counting_messages (fst (tr i) n'))
msg0: message
H_about0: get_message_type msg0 = PrepareBlock /\
get_view msg2 = get_view msg0 /\
get_block msg2 = get_block msg0 /\
In msg0 (snd (tr i))
get_view msg1 = get_view msg0
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
n': node
msg2: message
H_rest: In n' participants /\
get_message_type msg2 = PrepareVote /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2 (counting_messages (fst (tr i) n'))
msg0: message
H_about0: get_message_type msg0 = PrepareBlock /\
get_view msg2 = get_view msg0 /\
get_block msg2 = get_block msg0 /\
In msg0 (snd (tr i))
get_block msg1 = get_block msg0
  replace (get_view msg0) with (get_view msg2) by easy.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
n': node
msg2: message
H_rest: In n' participants /\
get_message_type msg2 = PrepareVote /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2 (counting_messages (fst (tr i) n'))
msg0: message
H_about0: get_message_type msg0 = PrepareBlock /\
get_view msg2 = get_view msg0 /\
get_block msg2 = get_block msg0 /\
In msg0 (snd (tr i))
get_view msg1 = get_view msg2
tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
n': node
msg2: message
H_rest: In n' participants /\
get_message_type msg2 = PrepareVote /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2 (counting_messages (fst (tr i) n'))
msg0: message
H_about0: get_message_type msg0 = PrepareBlock /\
get_view msg2 = get_view msg0 /\
get_block msg2 = get_block msg0 /\
In msg0 (snd (tr i))
get_block msg1 = get_block msg0
  tauto.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
n': node
msg2: message
H_rest: In n' participants /\
get_message_type msg2 = PrepareVote /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2 (counting_messages (fst (tr i) n'))
msg0: message
H_about0: get_message_type msg0 = PrepareBlock /\
get_view msg2 = get_view msg0 /\
get_block msg2 = get_block msg0 /\
In msg0 (snd (tr i))
get_block msg1 = get_block msg0
  replace (get_block msg0) with (get_block msg2) by easy.tr: GTrace
i: nat
msg1: message
H_prot: protocol_trace tr
H_sent1: In msg1 (snd (tr i))
H_type1: get_message_type msg1 = PrepareQC
n': node
msg2: message
H_rest: In n' participants /\
get_message_type msg2 = PrepareVote /\
get_view msg1 = get_view msg2 /\
get_block msg1 = get_block msg2 /\
In msg2 (counting_messages (fst (tr i) n'))
msg0: message
H_about0: get_message_type msg0 = PrepareBlock /\
get_view msg2 = get_view msg0 /\
get_block msg2 = get_block msg0 /\
In msg0 (snd (tr i))
get_block msg1 = get_block msg2
  tauto.
Qed.

We combine the four proofs above in the following global fact which concludes our proof of the first ingredient: we have shown that any block in global prepare stage in some view must have a PrepareBlock message in the global message buffer in that view.

Lemma prepare_stage_in_view_means_PrepareBlock_sent_global : 
  forall tr i b p,
    protocol_trace tr ->
    prepare_stage_in_view_global tr i b p -> 
    exists (msg : message), 
      get_message_type msg = PrepareBlock /\
      p = get_view msg /\
      b = get_block msg /\ 
      In msg (snd (tr i)).forall (tr : GTrace) (i : nat) (b : block) (p : nat),
protocol_trace tr ->
prepare_stage_in_view_global tr i b p ->
exists msg : message,
  get_message_type msg = PrepareBlock /\
  p = get_view msg /\
  b = get_block msg /\ In msg (snd (tr i))
Proof.forall (tr : GTrace) (i : nat) (b : block) (p : nat),
protocol_trace tr ->
prepare_stage_in_view_global tr i b p ->
exists msg : message,
  get_message_type msg = PrepareBlock /\
  p = get_view msg /\
  b = get_block msg /\ In msg (snd (tr i))
  intros tr i b p H_prot H_prepare.tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_prepare: prepare_stage_in_view_global tr i b p
exists msg : message,
  get_message_type msg = PrepareBlock /\
  p = get_view msg /\
  b = get_block msg /\ In msg (snd (tr i))
  apply prepare_means_PrepareVote_PrepareQC_exists_global in H_prepare; try assumption.tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
H_prepare: exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = p /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
exists msg : message,
  get_message_type msg = PrepareBlock /\
  p = get_view msg /\
  b = get_block msg /\ In msg (snd (tr i))
  destruct H_prepare as [msg1 [H_sent [H_view [H_block [H_type1 | H_type1]]]]];
  rewrite <- H_view; rewrite <- H_block.tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
msg1: message
H_sent: In msg1 (snd (tr i))
H_view: get_view msg1 = p
H_block: get_block msg1 = b
H_type1: get_message_type msg1 = PrepareVote
exists msg : message,
  get_message_type msg = PrepareBlock /\
  get_view msg1 = get_view msg /\
  get_block msg1 = get_block msg /\
  In msg (snd (tr i))
tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
msg1: message
H_sent: In msg1 (snd (tr i))
H_view: get_view msg1 = p
H_block: get_block msg1 = b
H_type1: get_message_type msg1 = PrepareQC
exists msg : message,
  get_message_type msg = PrepareBlock /\
  get_view msg1 = get_view msg /\
  get_block msg1 = get_block msg /\
  In msg (snd (tr i))
  now apply PrepareVote_sent_means_PrepareBlock_sent_global.tr: GTrace
i: nat
b: block
p: nat
H_prot: protocol_trace tr
msg1: message
H_sent: In msg1 (snd (tr i))
H_view: get_view msg1 = p
H_block: get_block msg1 = b
H_type1: get_message_type msg1 = PrepareQC
exists msg : message,
  get_message_type msg = PrepareBlock /\
  get_view msg1 = get_view msg /\
  get_block msg1 = get_block msg /\
  In msg (snd (tr i))
  now apply PrepareQC_sent_means_PrepareBlock_sent_global.
Qed.

Ingredient two: The piggyback block of PrepareBlock messages in some view is equal to the trigger message block from the previous view.

We formalize the second ingredient as follows:

Definition trigger_message_next_view_PrepareBlock_same_block_global :=
  forall (tr : GTrace)
    (H_prot : protocol_trace tr)
    (i : nat)
    (msg : message)
    (v : nat),
    trigger_message_global tr i v msg ->
    forall (pb_msg : message),
      get_message_type pb_msg = PrepareBlock ->
      get_view pb_msg = S v ->
      In pb_msg (snd (tr i)) ->
      get_piggyback_block pb_msg = get_block msg.

Ingredient three: All PrepareBlock messages have a lower piggyback block than proposed block

We show this height relation between piggyback and proposed blocks in PrepareBlock messages directly using induction on protocol traces - it is true by construction of PrepareBlock messages.

Lemma PrepareBlock_block_height_geq :
  forall (tr : GTrace),
    protocol_trace tr ->
    forall (i : nat) (msg : message),
      In msg (snd (tr i)) ->
      get_message_type msg = PrepareBlock -> 
      b_height (get_piggyback_block msg) <
      b_height (get_block msg).forall tr : GTrace,
protocol_trace tr ->
forall (i : nat) (msg : message),
In msg (snd (tr i)) ->
get_message_type msg = PrepareBlock ->
b_height (get_piggyback_block msg) <
b_height (get_block msg) 
Proof.forall tr : GTrace,
protocol_trace tr ->
forall (i : nat) (msg : message),
In msg (snd (tr i)) ->
get_message_type msg = PrepareBlock ->
b_height (get_piggyback_block msg) <
b_height (get_block msg)
  intros tr H_prot i msg H_in H_type.tr: GTrace
H_prot: protocol_trace tr
i: nat
msg: message
H_in: In msg (snd (tr i))
H_type: get_message_type msg = PrepareBlock
b_height (get_piggyback_block msg) <
b_height (get_block msg)
  pose proof H_prot as H_prot_copy.tr: GTrace
H_prot: protocol_trace tr
i: nat
msg: message
H_in: In msg (snd (tr i))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
b_height (get_piggyback_block msg) <
b_height (get_block msg)
  induction i as [|i IH_prot].tr: GTrace
H_prot: protocol_trace tr
msg: message
H_in: In msg (snd (tr 0))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
b_height (get_piggyback_block msg) <
b_height (get_block msg)
tr: GTrace
H_prot: protocol_trace tr
i: nat
msg: message
H_in: In msg (snd (tr (S i)))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
IH_prot: In msg (snd (tr i)) ->
b_height (get_piggyback_block msg) <
b_height (get_block msg)
b_height (get_piggyback_block msg) <
b_height (get_block msg)
  -tr: GTrace
H_prot: protocol_trace tr
msg: message
H_in: In msg (snd (tr 0))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
b_height (get_piggyback_block msg) <
b_height (get_block msg) destruct H_prot as [H_init _];
      rewrite H_init in H_in;
      inversion H_in. 
  -tr: GTrace
H_prot: protocol_trace tr
i: nat
msg: message
H_in: In msg (snd (tr (S i)))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
IH_prot: In msg (snd (tr i)) ->
b_height (get_piggyback_block msg) <
b_height (get_block msg)
b_height (get_piggyback_block msg) <
b_height (get_block msg) destruct (In_dec message_eq_dec msg (snd (tr i))) as [H_old | H_new].tr: GTrace
H_prot: protocol_trace tr
i: nat
msg: message
H_in: In msg (snd (tr (S i)))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
IH_prot: In msg (snd (tr i)) ->
b_height (get_piggyback_block msg) <
b_height (get_block msg)
H_old: In msg (snd (tr i))
b_height (get_piggyback_block msg) <
b_height (get_block msg)
tr: GTrace
H_prot: protocol_trace tr
i: nat
msg: message
H_in: In msg (snd (tr (S i)))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
IH_prot: In msg (snd (tr i)) ->
b_height (get_piggyback_block msg) <
b_height (get_block msg)
H_new: ~ In msg (snd (tr i))
b_height (get_piggyback_block msg) <
b_height (get_block msg)
    +tr: GTrace
H_prot: protocol_trace tr
i: nat
msg: message
H_in: In msg (snd (tr (S i)))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
IH_prot: In msg (snd (tr i)) ->
b_height (get_piggyback_block msg) <
b_height (get_block msg)
H_old: In msg (snd (tr i))
b_height (get_piggyback_block msg) <
b_height (get_block msg) spec IH_prot H_old.tr: GTrace
H_prot: protocol_trace tr
i: nat
msg: message
H_in: In msg (snd (tr (S i)))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
H_old: In msg (snd (tr i))
IH_prot: b_height (get_piggyback_block msg) <
b_height (get_block msg)
b_height (get_piggyback_block msg) <
b_height (get_block msg) assumption.
    +tr: GTrace
H_prot: protocol_trace tr
i: nat
msg: message
H_in: In msg (snd (tr (S i)))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
IH_prot: In msg (snd (tr i)) ->
b_height (get_piggyback_block msg) <
b_height (get_block msg)
H_new: ~ In msg (snd (tr i))
b_height (get_piggyback_block msg) <
b_height (get_block msg) clear IH_prot.tr: GTrace
H_prot: protocol_trace tr
i: nat
msg: message
H_in: In msg (snd (tr (S i)))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
H_new: ~ In msg (snd (tr i))
b_height (get_piggyback_block msg) <
b_height (get_block msg)
      destruct H_prot as [_ H_prot];
        spec H_prot i; 
        destruct H_prot as [[n0 [H_in0 [p0 [msg0 [lm0 [H_step H_deliver]]]]]] | H_timeout].tr: GTrace
i: nat
msg: message
H_in: In msg (snd (tr (S i)))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
H_new: ~ In msg (snd (tr i))
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
b_height (get_piggyback_block msg) <
b_height (get_block msg)
tr: GTrace
i: nat
msg: message
H_in: In msg (snd (tr (S i)))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
H_new: ~ In msg (snd (tr i))
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
b_height (get_piggyback_block msg) <
b_height (get_block msg)
      destruct (node_eq_dec n0 (get_sender msg)) as [H_true | H_false].tr: GTrace
i: nat
msg: message
H_in: In msg (snd (tr (S i)))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
H_new: ~ In msg (snd (tr i))
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_true: n0 = get_sender msg
b_height (get_piggyback_block msg) <
b_height (get_block msg)
tr: GTrace
i: nat
msg: message
H_in: In msg (snd (tr (S i)))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
H_new: ~ In msg (snd (tr i))
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_false: n0 <> get_sender msg
b_height (get_piggyback_block msg) <
b_height (get_block msg)
tr: GTrace
i: nat
msg: message
H_in: In msg (snd (tr (S i)))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
H_new: ~ In msg (snd (tr i))
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
b_height (get_piggyback_block msg) <
b_height (get_block msg)
      *tr: GTrace
i: nat
msg: message
H_in: In msg (snd (tr (S i)))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
H_new: ~ In msg (snd (tr i))
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_true: n0 = get_sender msg
b_height (get_piggyback_block msg) <
b_height (get_block msg) subst.tr: GTrace
i: nat
msg: message
H_in: In msg (snd (tr (S i)))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
H_new: ~ In msg (snd (tr i))
H_in0: In (get_sender msg) participants
p0: NState_transition_type
msg0: message
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i)
  (fst (tr i) (get_sender msg))
  (fst (tr (S i)) (get_sender msg)) lm0
H_step: get_transition p0
  (fst (tr i) (get_sender msg)) msg0
  (fst (tr (S i)) (get_sender msg)) lm0
b_height (get_piggyback_block msg) <
b_height (get_block msg)
        destruct p0;
          destruct H_step as [H_update [H_out H_rest]];
          rewrite H_out in H_deliver;
          rewrite H_deliver in H_in;
          simpl in H_in;
          try rewrite in_app_iff in H_in;
          repeat destruct H_in as [H_in | H_in]; 
          try contradiction;
          try (rewrite <- H_in in H_type;
               simpl in H_type;
               discriminate); 
          try (rewrite <- H_in;
               unfold get_piggyback_block, get_block;
               simpl;
               repeat rewrite about_generate_new_block;
               try rewrite GenesisBlock_height; 
               try rewrite about_generate_last_block; lia);
          try (apply pending_PrepareVote_correct in H_in;
               rewrite H_type in H_in; easy);
          try (rewrite <- H_in in H_type;
               rewrite H_type in H_rest; easy);
        try (rewrite <- H_in;
             unfold get_piggyback_block, get_block;
             simpl;
             rewrite (proj1 (about_generate_last_block
              (generate_new_block (generate_new_block (snd (fst msg0)) _) _) _));
             repeat rewrite about_generate_new_block;
             lia);
        try (rewrite <- H_in;
             unfold get_piggyback_block, get_block;
             simpl;
             rewrite (proj1 (about_generate_last_block
               (generate_new_block (generate_new_block (snd
                (fst (highest_ViewChange_message
                  (process (fst (tr i) (get_sender msg)) msg0)))) _) _) _));
             repeat rewrite about_generate_new_block;
             lia);
        try (rewrite <- H_in;
             unfold get_piggyback_block, get_block; 
             simpl;
             rewrite (proj1 (about_generate_last_block
              (generate_new_block (generate_new_block _ ))));
             repeat rewrite about_generate_new_block;
             lia).
      *  (* In the case that n0 is not the sender, contradiction *)tr: GTrace
i: nat
msg: message
H_in: In msg (snd (tr (S i)))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
H_new: ~ In msg (snd (tr i))
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_false: n0 <> get_sender msg
b_height (get_piggyback_block msg) <
b_height (get_block msg)
        rewrite H_deliver in H_in.tr: GTrace
i: nat
msg: message
n0: node
lm0: list message
H_in: In msg
  (snd
     (broadcast_messages 
        (tr i) (fst (tr i) n0)
        (fst (tr (S i)) n0) lm0))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
H_new: ~ In msg (snd (tr i))
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_false: n0 <> get_sender msg
b_height (get_piggyback_block msg) <
b_height (get_block msg)
         simpl in H_in.tr: GTrace
i: nat
msg: message
n0: node
lm0: list message
H_in: In msg (lm0 ++ snd (tr i))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
H_new: ~ In msg (snd (tr i))
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_false: n0 <> get_sender msg
b_height (get_piggyback_block msg) <
b_height (get_block msg) rewrite in_app_iff in H_in.tr: GTrace
i: nat
msg: message
n0: node
lm0: list message
H_in: In msg lm0 \/ In msg (snd (tr i))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
H_new: ~ In msg (snd (tr i))
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_false: n0 <> get_sender msg
b_height (get_piggyback_block msg) <
b_height (get_block msg)
         destruct H_in as [H_in | H_in];
           try contradiction.tr: GTrace
i: nat
msg: message
n0: node
lm0: list message
H_in: In msg lm0
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
H_new: ~ In msg (snd (tr i))
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_false: n0 <> get_sender msg
b_height (get_piggyback_block msg) <
b_height (get_block msg)
         assert (H_useful := delivered_means_sender_made_transition).tr: GTrace
i: nat
msg: message
n0: node
lm0: list message
H_in: In msg lm0
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
H_new: ~ In msg (snd (tr i))
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_false: n0 <> get_sender msg
H_useful: forall tr : GTrace,
protocol_trace tr ->
forall (i : nat) (msg : message)
  (n0 : node) (lm0 : list message),
In msg lm0 ->
In n0 participants ->
forall (p0 : NState_transition_type)
  (msg0 : message),
get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0 ->
tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0 ->
get_sender msg = n0
b_height (get_piggyback_block msg) <
b_height (get_block msg)
         spec H_useful tr H_prot_copy i msg n0 lm0 H_in H_in0.tr: GTrace
i: nat
msg: message
n0: node
lm0: list message
H_in: In msg lm0
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
H_new: ~ In msg (snd (tr i))
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_false: n0 <> get_sender msg
H_useful: forall (p0 : NState_transition_type)
  (msg0 : message),
get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0 ->
tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0 ->
get_sender msg = n0
b_height (get_piggyback_block msg) <
b_height (get_block msg)
         spec H_useful p0 msg0 H_step H_deliver.tr: GTrace
i: nat
msg: message
n0: node
lm0: list message
H_in: In msg lm0
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
H_new: ~ In msg (snd (tr i))
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_false: n0 <> get_sender msg
H_useful: get_sender msg = n0
b_height (get_piggyback_block msg) <
b_height (get_block msg)
         symmetry in H_useful; easy.
      *tr: GTrace
i: nat
msg: message
H_in: In msg (snd (tr (S i)))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
H_new: ~ In msg (snd (tr i))
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
b_height (get_piggyback_block msg) <
b_height (get_block msg) rewrite H_timeout in H_in.tr: GTrace
i: nat
msg: message
H_in: In msg
  (snd
     (fun n : node =>
      if is_member n participants
      then flip_timeout (fst (tr i) n)
      else fst (tr i) n, 
      snd (tr i)))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
H_new: ~ In msg (snd (tr i))
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
b_height (get_piggyback_block msg) <
b_height (get_block msg)
        simpl in H_in.tr: GTrace
i: nat
msg: message
H_in: In msg (snd (tr i))
H_type: get_message_type msg = PrepareBlock
H_prot_copy: protocol_trace tr
H_new: ~ In msg (snd (tr i))
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
b_height (get_piggyback_block msg) <
b_height (get_block msg) contradiction.
Qed.

Proof of the lower bound

With the three ingredients at hand, we are ready to prove our lower bound.

Lemma past_view_trigger_message_lowest_block_global :
  trigger_message_next_view_PrepareBlock_same_block_global -> 
  forall tr i n p msg, protocol_trace tr ->
    In n participants ->
    trigger_message_global tr i p msg ->
    forall b, prepare_stage_in_view_global tr i b (S p) ->
      b_height b > b_height (get_block msg).trigger_message_next_view_PrepareBlock_same_block_global ->
forall (tr : GTrace) (i : nat) (n : node) (p : nat)
  (msg : message),
protocol_trace tr ->
In n participants ->
trigger_message_global tr i p msg ->
forall b : block,
prepare_stage_in_view_global tr i b (S p) ->
b_height b > b_height (get_block msg) 
Proof.trigger_message_next_view_PrepareBlock_same_block_global ->
forall (tr : GTrace) (i : nat) (n : node) (p : nat)
  (msg : message),
protocol_trace tr ->
In n participants ->
trigger_message_global tr i p msg ->
forall b : block,
prepare_stage_in_view_global tr i b (S p) ->
b_height b > b_height (get_block msg) 
  intros H_useful2 tr i n p msg H_prot H_part H_trigger b H_prepare.H_useful2: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
i: nat
n: node
p: nat
msg: message
H_prot: protocol_trace tr
H_part: In n participants
H_trigger: trigger_message_global tr i p msg
b: block
H_prepare: prepare_stage_in_view_global tr i b (S p)
b_height b > b_height (get_block msg)
  (* Enter ingredient one: *)
  assert (H_useful1 := prepare_stage_in_view_means_PrepareBlock_sent_global).H_useful2: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
i: nat
n: node
p: nat
msg: message
H_prot: protocol_trace tr
H_part: In n participants
H_trigger: trigger_message_global tr i p msg
b: block
H_prepare: prepare_stage_in_view_global tr i b (S p)
H_useful1: forall (tr : GTrace) (i : nat) 
  (b : block) (p : nat),
protocol_trace tr ->
prepare_stage_in_view_global tr i b p ->
exists msg : message,
  get_message_type msg = PrepareBlock /\
  p = get_view msg /\
  b = get_block msg /\ In msg (snd (tr i))
b_height b > b_height (get_block msg) 
  spec H_useful1 tr i b (S p) H_prot H_prepare.H_useful2: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
i: nat
n: node
p: nat
msg: message
H_prot: protocol_trace tr
H_part: In n participants
H_trigger: trigger_message_global tr i p msg
b: block
H_prepare: prepare_stage_in_view_global tr i b (S p)
H_useful1: exists msg : message,
  get_message_type msg = PrepareBlock /\
  S p = get_view msg /\
  b = get_block msg /\ In msg (snd (tr i))
b_height b > b_height (get_block msg)
  destruct H_useful1 as [prepare_msg [H_type [H_view [H_block H_sent]]]].H_useful2: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
i: nat
n: node
p: nat
msg: message
H_prot: protocol_trace tr
H_part: In n participants
H_trigger: trigger_message_global tr i p msg
b: block
H_prepare: prepare_stage_in_view_global tr i b (S p)
prepare_msg: message
H_type: get_message_type prepare_msg = PrepareBlock
H_view: S p = get_view prepare_msg
H_block: b = get_block prepare_msg
H_sent: In prepare_msg (snd (tr i))
b_height b > b_height (get_block msg)
  (* Enter ingredient two: *) 
  symmetry in H_view.H_useful2: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
i: nat
n: node
p: nat
msg: message
H_prot: protocol_trace tr
H_part: In n participants
H_trigger: trigger_message_global tr i p msg
b: block
H_prepare: prepare_stage_in_view_global tr i b (S p)
prepare_msg: message
H_type: get_message_type prepare_msg = PrepareBlock
H_view: get_view prepare_msg = S p
H_block: b = get_block prepare_msg
H_sent: In prepare_msg (snd (tr i))
b_height b > b_height (get_block msg)
  spec H_useful2 tr H_prot i msg p H_trigger.tr: GTrace
i: nat
n: node
p: nat
msg: message
H_prot: protocol_trace tr
H_part: In n participants
H_trigger: trigger_message_global tr i p msg
b: block
H_prepare: prepare_stage_in_view_global tr i b (S p)
prepare_msg: message
H_type: get_message_type prepare_msg = PrepareBlock
H_view: get_view prepare_msg = S p
H_block: b = get_block prepare_msg
H_sent: In prepare_msg (snd (tr i))
H_useful2: forall pb_msg : message,
get_message_type pb_msg = PrepareBlock ->
get_view pb_msg = S p ->
In pb_msg (snd (tr i)) ->
get_piggyback_block pb_msg = get_block msg
b_height b > b_height (get_block msg)
  spec H_useful2 prepare_msg H_type H_view H_sent.tr: GTrace
i: nat
n: node
p: nat
msg: message
H_prot: protocol_trace tr
H_part: In n participants
H_trigger: trigger_message_global tr i p msg
b: block
H_prepare: prepare_stage_in_view_global tr i b (S p)
prepare_msg: message
H_type: get_message_type prepare_msg = PrepareBlock
H_view: get_view prepare_msg = S p
H_block: b = get_block prepare_msg
H_sent: In prepare_msg (snd (tr i))
H_useful2: get_piggyback_block prepare_msg =
get_block msg
b_height b > b_height (get_block msg) 
  rewrite <- H_useful2.tr: GTrace
i: nat
n: node
p: nat
msg: message
H_prot: protocol_trace tr
H_part: In n participants
H_trigger: trigger_message_global tr i p msg
b: block
H_prepare: prepare_stage_in_view_global tr i b (S p)
prepare_msg: message
H_type: get_message_type prepare_msg = PrepareBlock
H_view: get_view prepare_msg = S p
H_block: b = get_block prepare_msg
H_sent: In prepare_msg (snd (tr i))
H_useful2: get_piggyback_block prepare_msg =
get_block msg
b_height b >
b_height (get_piggyback_block prepare_msg)
  (* Enter ingredient three: *)
  assert (H_useful3 := PrepareBlock_block_height_geq).tr: GTrace
i: nat
n: node
p: nat
msg: message
H_prot: protocol_trace tr
H_part: In n participants
H_trigger: trigger_message_global tr i p msg
b: block
H_prepare: prepare_stage_in_view_global tr i b (S p)
prepare_msg: message
H_type: get_message_type prepare_msg = PrepareBlock
H_view: get_view prepare_msg = S p
H_block: b = get_block prepare_msg
H_sent: In prepare_msg (snd (tr i))
H_useful2: get_piggyback_block prepare_msg =
get_block msg
H_useful3: forall tr : GTrace,
protocol_trace tr ->
forall (i : nat) (msg : message),
In msg (snd (tr i)) ->
get_message_type msg = PrepareBlock ->
b_height (get_piggyback_block msg) <
b_height (get_block msg)
b_height b >
b_height (get_piggyback_block prepare_msg)
  spec H_useful3 tr H_prot i prepare_msg H_sent H_type.tr: GTrace
i: nat
n: node
p: nat
msg: message
H_prot: protocol_trace tr
H_part: In n participants
H_trigger: trigger_message_global tr i p msg
b: block
H_prepare: prepare_stage_in_view_global tr i b (S p)
prepare_msg: message
H_type: get_message_type prepare_msg = PrepareBlock
H_view: get_view prepare_msg = S p
H_block: b = get_block prepare_msg
H_sent: In prepare_msg (snd (tr i))
H_useful2: get_piggyback_block prepare_msg =
get_block msg
H_useful3: b_height (get_piggyback_block prepare_msg) <
b_height (get_block prepare_msg)
b_height b >
b_height (get_piggyback_block prepare_msg)
  rewrite H_block.tr: GTrace
i: nat
n: node
p: nat
msg: message
H_prot: protocol_trace tr
H_part: In n participants
H_trigger: trigger_message_global tr i p msg
b: block
H_prepare: prepare_stage_in_view_global tr i b (S p)
prepare_msg: message
H_type: get_message_type prepare_msg = PrepareBlock
H_view: get_view prepare_msg = S p
H_block: b = get_block prepare_msg
H_sent: In prepare_msg (snd (tr i))
H_useful2: get_piggyback_block prepare_msg =
get_block msg
H_useful3: b_height (get_piggyback_block prepare_msg) <
b_height (get_block prepare_msg)
b_height (get_block prepare_msg) >
b_height (get_piggyback_block prepare_msg)
  lia. 
Qed.

Global trigger message blocks as upper bounds

Second, we show that the height of the block contained in the trigger message for a view is the highest or second highest of all blocks that reach prepare stage in the present view.

We know that trigger messages are either PrepareQC messages for the last proposed block, in the case of normal view change, or ViewChangeQC messages for the max height block, in the case of abnormal view change.

Therefore, we must show this height property for each case.

The normal view change case.

Definition normal_trigger_message_highest_global_statement :=
  forall tr i p msg h_max, protocol_trace tr ->
    normal_trigger_message_global tr i p msg ->
    is_max_prepare_height_in_view_global tr i h_max p ->
    b_height (get_block msg) = h_max.

In the abnormal view change case:

Definition timeout_trigger_message_highest_or_second_highest_global_statement :=
  forall tr i p msg h_max, protocol_trace tr ->
    timeout_trigger_message_global tr i p msg ->
    is_max_prepare_height_in_view_global tr i h_max p ->
    b_height (get_block msg) = h_max \/
    b_height (get_block msg) = h_max - 1.

The two cases amount to the following:

Definition trigger_message_highest_or_second_highest_global_statement :=
  forall tr i p msg h_max, protocol_trace tr ->
    trigger_message_global tr i p msg ->
    is_max_prepare_height_in_view_global tr i h_max p ->
    b_height (get_block msg) = h_max \/
    b_height (get_block msg) = h_max - 1.

Normal view change trigger message contains the highest block

In the normal view change case, the proof is relatively straightforward. The trigger message is a PrepareQC for the last block proposed in the view. If there exists a PrepareQC message for that block, there must exist a PrepareBlock message for that block. By construction of PrepareBlock messages, the last block proposed in the view is the highest block. Therefore, the block contained in the trigger message is the highest prepare stage block in the view.

We first establish a connection between the block contained in the normal trigger message and its corresponding PrepareBlock message.

Nodes cannot send messages labeled with a view greater than its current view:

Lemma out_message_view_bound :
  forall tr n i, protocol_trace tr ->
    In n participants ->
    forall msg,
      In msg (out_messages (fst (tr i) n)) ->
      get_view msg <= node_view (fst (tr i) n).forall (tr : GTrace) (n : node) (i : nat),
protocol_trace tr ->
In n participants ->
forall msg : message,
In msg (out_messages (fst (tr i) n)) ->
get_view msg <= node_view (fst (tr i) n) 
Proof.forall (tr : GTrace) (n : node) (i : nat),
protocol_trace tr ->
In n participants ->
forall msg : message,
In msg (out_messages (fst (tr i) n)) ->
get_view msg <= node_view (fst (tr i) n)
  intros tr n i H_prot H_part msg H_sent.tr: GTrace
n: node
i: nat
H_prot: protocol_trace tr
H_part: In n participants
msg: message
H_sent: In msg (out_messages (fst (tr i) n))
get_view msg <= node_view (fst (tr i) n)
  induction i as [|i IH_prot].tr: GTrace
n: node
H_prot: protocol_trace tr
H_part: In n participants
msg: message
H_sent: In msg (out_messages (fst (tr 0) n))
get_view msg <= node_view (fst (tr 0) n)
tr: GTrace
n: node
i: nat
H_prot: protocol_trace tr
H_part: In n participants
msg: message
H_sent: In msg (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
get_view msg <= node_view (fst (tr i) n)
get_view msg <= node_view (fst (tr (S i)) n)
  -tr: GTrace
n: node
H_prot: protocol_trace tr
H_part: In n participants
msg: message
H_sent: In msg (out_messages (fst (tr 0) n))
get_view msg <= node_view (fst (tr 0) n) destruct H_prot as [H_init _];
      rewrite H_init in H_sent;
      inversion H_sent.
  -tr: GTrace
n: node
i: nat
H_prot: protocol_trace tr
H_part: In n participants
msg: message
H_sent: In msg (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
get_view msg <= node_view (fst (tr i) n)
get_view msg <= node_view (fst (tr (S i)) n) assert (H_view := view_same_or_plus_one i n H_prot H_part).tr: GTrace
n: node
i: nat
H_prot: protocol_trace tr
H_part: In n participants
msg: message
H_sent: In msg (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
get_view msg <= node_view (fst (tr i) n)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
get_view msg <= node_view (fst (tr (S i)) n)
    destruct (In_dec message_eq_dec msg (out_messages (fst (tr i) n))) as [H_old | H_new].tr: GTrace
n: node
i: nat
H_prot: protocol_trace tr
H_part: In n participants
msg: message
H_sent: In msg (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
get_view msg <= node_view (fst (tr i) n)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_old: In msg (out_messages (fst (tr i) n))
get_view msg <= node_view (fst (tr (S i)) n)
tr: GTrace
n: node
i: nat
H_prot: protocol_trace tr
H_part: In n participants
msg: message
H_sent: In msg (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
get_view msg <= node_view (fst (tr i) n)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~ In msg (out_messages (fst (tr i) n))
get_view msg <= node_view (fst (tr (S i)) n)
    + (* In the case that the message is old *)tr: GTrace
n: node
i: nat
H_prot: protocol_trace tr
H_part: In n participants
msg: message
H_sent: In msg (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
get_view msg <= node_view (fst (tr i) n)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_old: In msg (out_messages (fst (tr i) n))
get_view msg <= node_view (fst (tr (S i)) n)
      spec IH_prot H_old; lia.
    + (* In the case that the message is new *)tr: GTrace
n: node
i: nat
H_prot: protocol_trace tr
H_part: In n participants
msg: message
H_sent: In msg (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
get_view msg <= node_view (fst (tr i) n)
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~ In msg (out_messages (fst (tr i) n))
get_view msg <= node_view (fst (tr (S i)) n)
      clear IH_prot.tr: GTrace
n: node
i: nat
H_prot: protocol_trace tr
H_part: In n participants
msg: message
H_sent: In msg (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~ In msg (out_messages (fst (tr i) n))
get_view msg <= node_view (fst (tr (S i)) n)
      assert (H_prot_copy := H_prot); 
        destruct H_prot as [_ H_prot];
        spec H_prot i;
        destruct H_prot as [[n0 [H_in0 [p0 [msg0 [lm0 [H_step H_deliver]]]]]] | H_timeout].tr: GTrace
n: node
i: nat
H_part: In n participants
msg: message
H_sent: In msg (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
get_view msg <= node_view (fst (tr (S i)) n)
tr: GTrace
n: node
i: nat
H_part: In n participants
msg: message
H_sent: In msg (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
get_view msg <= node_view (fst (tr (S i)) n)
      * (* In the normal transition case *)tr: GTrace
n: node
i: nat
H_part: In n participants
msg: message
H_sent: In msg (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
get_view msg <= node_view (fst (tr (S i)) n)
        assert (n0 = n).tr: GTrace
n: node
i: nat
H_part: In n participants
msg: message
H_sent: In msg (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
n0 = n
tr: GTrace
n: node
i: nat
H_part: In n participants
msg: message
H_sent: In msg (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H: n0 = n
get_view msg <= node_view (fst (tr (S i)) n)
        {tr: GTrace
n: node
i: nat
H_part: In n participants
msg: message
H_sent: In msg (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
n0 = n apply out_message_change_tells_sender
           with tr i p0 msg0 lm0; try assumption.tr: GTrace
n: node
i: nat
H_part: In n participants
msg: message
H_sent: In msg (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
exists msg : message,
  In msg (out_messages (fst (tr (S i)) n)) /\
  ~ In msg (out_messages (fst (tr i) n)) exists msg; tauto. }tr: GTrace
n: node
i: nat
H_part: In n participants
msg: message
H_sent: In msg (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H: n0 = n
get_view msg <= node_view (fst (tr (S i)) n)
        subst.tr: GTrace
n: node
i: nat
H_part: In n participants
msg: message
H_sent: In msg (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
p0: NState_transition_type
msg0: message
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_step: get_transition p0 (fst (tr i) n) msg0
  (fst (tr (S i)) n) lm0
get_view msg <= node_view (fst (tr (S i)) n)
        destruct p0;
          destruct H_step as [H_update H_rest];
          rewrite H_update in H_sent;
          simpl in H_sent;
          try rewrite in_app_iff in H_sent; 
          repeat destruct H_sent as [H_sent | H_sent];
          try contradiction;
          rewrite H_update; simpl; 
            try (rewrite <- H_sent;
                 unfold get_view; simpl; lia);
            assert (H_valid : view_valid (fst (tr i) n) msg0) by tauto;
            rewrite H_valid; 
            try (apply pending_PrepareVote_correct in H_sent;
                 destruct H_sent as [_ [_ H_view_msg]];
                 rewrite H_view_msg;
                 unfold view_valid in H_rest;
                 replace (get_view msg0) with (node_view (fst (tr i) n)) by easy;
                 lia);
            try (subst; lia).
      * (* In the timeout case *)tr: GTrace
n: node
i: nat
H_part: In n participants
msg: message
H_sent: In msg (out_messages (fst (tr (S i)) n))
H_view: node_view (fst (tr i) n) =
node_view (fst (tr (S i)) n) \/
S (node_view (fst (tr i) n)) =
node_view (fst (tr (S i)) n)
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
get_view msg <= node_view (fst (tr (S i)) n) 
        rewrite H_timeout in H_sent;
          simpl in H_sent; 
          apply is_member_correct in H_part;
          rewrite H_part in H_sent;
          contradiction.
Qed.

At the local out message buffer level, blocks tagged as last block are higher than any other block in the same view:

Lemma last_block_highest_block_sent :
 forall (tr : GTrace) (n : node), In n participants ->
 forall (i p : nat) (msg : message), protocol_trace tr ->
  get_message_type msg = PrepareBlock ->
  get_view msg = p ->
  In msg (out_messages (fst (tr i) n)) ->
  b_last (get_block msg) = true ->
  forall (msg' : message), get_message_type msg' = PrepareBlock ->
  get_view msg' = p ->
  In msg' (out_messages (fst (tr i) n)) ->
  b_height (get_block msg) >= b_height (get_block msg').forall (tr : GTrace) (n : node),
In n participants ->
forall (i p : nat) (msg : message),
protocol_trace tr ->
get_message_type msg = PrepareBlock ->
get_view msg = p ->
In msg (out_messages (fst (tr i) n)) ->
b_last (get_block msg) = true ->
forall msg' : message,
get_message_type msg' = PrepareBlock ->
get_view msg' = p ->
In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >= b_height (get_block msg')
Proof.forall (tr : GTrace) (n : node),
In n participants ->
forall (i p : nat) (msg : message),
protocol_trace tr ->
get_message_type msg = PrepareBlock ->
get_view msg = p ->
In msg (out_messages (fst (tr i) n)) ->
b_last (get_block msg) = true ->
forall msg' : message,
get_message_type msg' = PrepareBlock ->
get_view msg' = p ->
In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >= b_height (get_block msg')
  intros tr n H_part i p msg H_prot H_type H_view H_in H_last msg' H_type' H_view' H_in'.tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr i) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr i) n))
b_height (get_block msg) >= b_height (get_block msg')
   induction i as [|i IH_prot]; intros.tr: GTrace
n: node
H_part: In n participants
p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr 0) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr 0) n))
b_height (get_block msg) >= b_height (get_block msg')
tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
b_height (get_block msg) >= b_height (get_block msg') 
  -tr: GTrace
n: node
H_part: In n participants
p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr 0) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr 0) n))
b_height (get_block msg) >= b_height (get_block msg') destruct H_prot as [H_init _];
      rewrite H_init in H_in';
      inversion H_in'.
  -tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
b_height (get_block msg) >= b_height (get_block msg') assert (H_prot_copy := H_prot); 
        destruct H_prot as [_ H_prot];
        spec H_prot i;
        destruct H_prot as [[n0 [H_in0 [p0 [msg0 [lm0 [H_step H_deliver]]]]]] | H_timeout].tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
b_height (get_block msg) >= b_height (get_block msg')
tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
b_height (get_block msg) >= b_height (get_block msg')
    * (* In the normal transition case *)tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
b_height (get_block msg) >= b_height (get_block msg')
      destruct (In_dec message_eq_dec msg (out_messages (fst (tr i) n))) as [H_old | H_new];
        destruct (In_dec message_eq_dec msg' (out_messages (fst (tr i) n))) as [H_old' | H_new'].tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_old: In msg (out_messages (fst (tr i) n))
H_old': In msg' (out_messages (fst (tr i) n))
b_height (get_block msg) >= b_height (get_block msg')
tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_old: In msg (out_messages (fst (tr i) n))
H_new': ~ In msg' (out_messages (fst (tr i) n))
b_height (get_block msg) >= b_height (get_block msg')
tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_new: ~ In msg (out_messages (fst (tr i) n))
H_old': In msg' (out_messages (fst (tr i) n))
b_height (get_block msg) >= b_height (get_block msg')
tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_new: ~ In msg (out_messages (fst (tr i) n))
H_new': ~ In msg' (out_messages (fst (tr i) n))
b_height (get_block msg) >= b_height (get_block msg')
    + (* In case both messages are old *)tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_old: In msg (out_messages (fst (tr i) n))
H_old': In msg' (out_messages (fst (tr i) n))
b_height (get_block msg) >= b_height (get_block msg')
      now spec IH_prot H_old H_old'.
    + (* In case msg' is new and msg is old *)tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_old: In msg (out_messages (fst (tr i) n))
H_new': ~ In msg' (out_messages (fst (tr i) n))
b_height (get_block msg) >= b_height (get_block msg')
      clear IH_prot.tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_old: In msg (out_messages (fst (tr i) n))
H_new': ~ In msg' (out_messages (fst (tr i) n))
b_height (get_block msg) >= b_height (get_block msg')
      assert (n0 = n).tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_old: In msg (out_messages (fst (tr i) n))
H_new': ~ In msg' (out_messages (fst (tr i) n))
n0 = n
tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_old: In msg (out_messages (fst (tr i) n))
H_new': ~ In msg' (out_messages (fst (tr i) n))
H: n0 = n
b_height (get_block msg) >= b_height (get_block msg')
      {tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_old: In msg (out_messages (fst (tr i) n))
H_new': ~ In msg' (out_messages (fst (tr i) n))
n0 = n apply out_message_change_tells_sender with tr i p0 msg0 lm0; try assumption.tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_old: In msg (out_messages (fst (tr i) n))
H_new': ~ In msg' (out_messages (fst (tr i) n))
exists msg : message,
  In msg (out_messages (fst (tr (S i)) n)) /\
  ~ In msg (out_messages (fst (tr i) n)) exists msg'; tauto. }tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_old: In msg (out_messages (fst (tr i) n))
H_new': ~ In msg' (out_messages (fst (tr i) n))
H: n0 = n
b_height (get_block msg) >= b_height (get_block msg')
      subst.tr: GTrace
n: node
H_part: In n participants
i: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = get_view msg
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
p0: NState_transition_type
msg0: message
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_step: get_transition p0 (fst (tr i) n) msg0
  (fst (tr (S i)) n) lm0
H_old: In msg (out_messages (fst (tr i) n))
H_new': ~ In msg' (out_messages (fst (tr i) n))
b_height (get_block msg) >= b_height (get_block msg')
      destruct (message_eq_dec msg msg') as [H_eq | H_neq]; try (subst; lia).tr: GTrace
n: node
H_part: In n participants
i: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = get_view msg
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
p0: NState_transition_type
msg0: message
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_step: get_transition p0 (fst (tr i) n) msg0
  (fst (tr (S i)) n) lm0
H_old: In msg (out_messages (fst (tr i) n))
H_new': ~ In msg' (out_messages (fst (tr i) n))
H_neq: msg <> msg'
b_height (get_block msg) >= b_height (get_block msg')
      destruct p0;
        assert (H_step_copy := H_step); 
        destruct H_step as [H_update [H_out H_rest]];
        rewrite H_update in H_in';
        simpl in H_in';
        (* In all the cases that don't send messages *) 
        try contradiction;
        (* In all the type contradiction for msg cases *)
        try rewrite in_app_iff in H_in';
        repeat destruct H_in' as [H_in' | H_in'];
        try contradiction;
        try (rewrite <- H_in' in H_type';
             discriminate);
        try (apply pending_PrepareVote_correct in H_in'; rewrite H_type' in H_in'; easy);
        try (subst; rewrite H_type' in H_rest; easy);
        try (assert (H_bound : get_view msg <= node_view (fst (tr i) n)) by 
                (apply out_message_view_bound; assumption);
             rewrite <- H_in' in H_view';
             unfold get_view in H_view' at 1; simpl in H_view';
             rewrite <- H_view' in H_bound; lia);
        (* In the initial block proposal case *)
        try (assert (H_init : fst (tr i) n = NState_init (node_id (fst (tr i) n))) by tauto;
             rewrite H_init in H_old;
             inversion H_old).
    + (* In case msg is new and msg' is old *)tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_new: ~ In msg (out_messages (fst (tr i) n))
H_old': In msg' (out_messages (fst (tr i) n))
b_height (get_block msg) >= b_height (get_block msg')
            clear IH_prot.tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_new: ~ In msg (out_messages (fst (tr i) n))
H_old': In msg' (out_messages (fst (tr i) n))
b_height (get_block msg) >= b_height (get_block msg')
      assert (n0 = n).tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_new: ~ In msg (out_messages (fst (tr i) n))
H_old': In msg' (out_messages (fst (tr i) n))
n0 = n
tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_new: ~ In msg (out_messages (fst (tr i) n))
H_old': In msg' (out_messages (fst (tr i) n))
H: n0 = n
b_height (get_block msg) >= b_height (get_block msg')
      {tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_new: ~ In msg (out_messages (fst (tr i) n))
H_old': In msg' (out_messages (fst (tr i) n))
n0 = n apply out_message_change_tells_sender
         with tr i p0 msg0 lm0; try assumption.tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_new: ~ In msg (out_messages (fst (tr i) n))
H_old': In msg' (out_messages (fst (tr i) n))
exists msg : message,
  In msg (out_messages (fst (tr (S i)) n)) /\
  ~ In msg (out_messages (fst (tr i) n)) exists msg; tauto. }tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_new: ~ In msg (out_messages (fst (tr i) n))
H_old': In msg' (out_messages (fst (tr i) n))
H: n0 = n
b_height (get_block msg) >= b_height (get_block msg')
      subst.tr: GTrace
n: node
H_part: In n participants
i: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = get_view msg
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
p0: NState_transition_type
msg0: message
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_step: get_transition p0 (fst (tr i) n) msg0
  (fst (tr (S i)) n) lm0
H_new: ~ In msg (out_messages (fst (tr i) n))
H_old': In msg' (out_messages (fst (tr i) n))
b_height (get_block msg) >= b_height (get_block msg')
      destruct (message_eq_dec msg msg') as [H_eq | H_neq]; try (subst; lia).tr: GTrace
n: node
H_part: In n participants
i: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = get_view msg
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
p0: NState_transition_type
msg0: message
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_step: get_transition p0 (fst (tr i) n) msg0
  (fst (tr (S i)) n) lm0
H_new: ~ In msg (out_messages (fst (tr i) n))
H_old': In msg' (out_messages (fst (tr i) n))
H_neq: msg <> msg'
b_height (get_block msg) >= b_height (get_block msg')
      destruct p0;
        assert (H_step_copy := H_step); 
        destruct H_step as [H_update [H_out H_rest]];
        rewrite H_update in H_in;
        simpl in H_in;
        (* In all the cases that don't send messages *) 
        try contradiction;
        (* In all the type contradiction for msg cases *)
        try rewrite in_app_iff in H_in;
        repeat destruct H_in as [H_in | H_in];
        try contradiction;
        try (rewrite <- H_in in H_type;
             discriminate);
        try (apply pending_PrepareVote_correct in H_in; rewrite H_type in H_in; easy);
        try (subst; rewrite H_type in H_rest; easy);
        try (assert (H_bound : get_view msg' <= node_view (fst (tr i) n)) by 
                (apply out_message_view_bound; assumption);
             rewrite <- H_in in H_view';
             unfold get_view in H_view' at 2; simpl in H_view';
             rewrite H_view' in H_bound; lia);
        (* In the initial block proposal case *)
        try (assert (H_init : fst (tr i) n = NState_init (node_id (fst (tr i) n))) by tauto;
             rewrite H_init in H_old';
             inversion H_old').
    + (* In case both messages are new *)tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_new: ~ In msg (out_messages (fst (tr i) n))
H_new': ~ In msg' (out_messages (fst (tr i) n))
b_height (get_block msg) >= b_height (get_block msg')
       clear IH_prot.tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_new: ~ In msg (out_messages (fst (tr i) n))
H_new': ~ In msg' (out_messages (fst (tr i) n))
b_height (get_block msg) >= b_height (get_block msg')
      assert (n0 = n).tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_new: ~ In msg (out_messages (fst (tr i) n))
H_new': ~ In msg' (out_messages (fst (tr i) n))
n0 = n
tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_new: ~ In msg (out_messages (fst (tr i) n))
H_new': ~ In msg' (out_messages (fst (tr i) n))
H: n0 = n
b_height (get_block msg) >= b_height (get_block msg')
      {tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_new: ~ In msg (out_messages (fst (tr i) n))
H_new': ~ In msg' (out_messages (fst (tr i) n))
n0 = n apply out_message_change_tells_sender with tr i p0 msg0 lm0; try assumption.tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_new: ~ In msg (out_messages (fst (tr i) n))
H_new': ~ In msg' (out_messages (fst (tr i) n))
exists msg : message,
  In msg (out_messages (fst (tr (S i)) n)) /\
  ~ In msg (out_messages (fst (tr i) n)) exists msg'; tauto. }tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_new: ~ In msg (out_messages (fst (tr i) n))
H_new': ~ In msg' (out_messages (fst (tr i) n))
H: n0 = n
b_height (get_block msg) >= b_height (get_block msg')
      subst.tr: GTrace
n: node
H_part: In n participants
i: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = get_view msg
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
p0: NState_transition_type
msg0: message
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_step: get_transition p0 (fst (tr i) n) msg0
  (fst (tr (S i)) n) lm0
H_new: ~ In msg (out_messages (fst (tr i) n))
H_new': ~ In msg' (out_messages (fst (tr i) n))
b_height (get_block msg) >= b_height (get_block msg')
      destruct (message_eq_dec msg msg') as [H_eq | H_neq]; try (subst; lia).tr: GTrace
n: node
H_part: In n participants
i: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = get_view msg
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
p0: NState_transition_type
msg0: message
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_step: get_transition p0 (fst (tr i) n) msg0
  (fst (tr (S i)) n) lm0
H_new: ~ In msg (out_messages (fst (tr i) n))
H_new': ~ In msg' (out_messages (fst (tr i) n))
H_neq: msg <> msg'
b_height (get_block msg) >= b_height (get_block msg')
      destruct p0;
        assert (H_step_copy := H_step); 
        destruct H_step as [H_update [H_out H_rest]];
        rewrite H_update in H_in;
        simpl in H_in;
        (* In all the cases that don't send messages *) 
        try contradiction;
        (* In all the type contradiction for msg cases *)
        try rewrite in_app_iff in H_in;
        repeat destruct H_in as [H_in | H_in];
          try contradiction;
          try (rewrite <- H_in in H_type;
               discriminate);
          try (apply pending_PrepareVote_correct in H_in; rewrite H_type in H_in; easy);
          try (subst; rewrite H_type in H_rest; easy);
          (* In all the non-last block for msg cases *) 
          try (rewrite <- H_in in H_last; 
               simpl in H_last;
               rewrite about_non_last_block in H_last;
               discriminate);
          (* Three remaining PrepareBlock cases *)
          rewrite H_update in H_in';
          simpl in H_in';
          (* In all the cases that don't send messages *) 
          try contradiction;
          (* In all the type contradiction for msg' cases *)
          try rewrite in_app_iff in H_in';
          repeat destruct H_in' as [H_in' | H_in'];
          try contradiction;
          try (rewrite <- H_in' in H_type';
               simpl in H_type'; 
               discriminate);
          try (apply pending_PrepareVote_correct in H_in'; rewrite H_type in H_in'; easy);
          try (subst; rewrite H_type in H_rest; easy);
          try (rewrite H_in' in H_rest;
               rewrite H_type' in H_rest;
               easy);
          (* Finally, in the remaining cases *)
          rewrite <- H_in;
          rewrite <- H_in';
          try (simpl;
               try repeat rewrite (proj1 (about_generate_last_block _));
               try repeat rewrite (about_generate_new_block _);
               lia).
      * (* In the timeout case *)tr: GTrace
n: node
H_part: In n participants
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
b_height (get_block msg) >= b_height (get_block msg')
        apply is_member_correct in H_part.tr: GTrace
n: node
H_part: is_member n participants = true
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
b_height (get_block msg) >= b_height (get_block msg')
        spec IH_prot.tr: GTrace
n: node
H_part: is_member n participants = true
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
In msg (out_messages (fst (tr i) n))
tr: GTrace
n: node
H_part: is_member n participants = true
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
IH_prot: In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
b_height (get_block msg) >= b_height (get_block msg')
        rewrite H_timeout in H_in.tr: GTrace
n: node
H_part: is_member n participants = true
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg
  (out_messages
     (fst
        (fun n : node =>
         if is_member n participants
         then flip_timeout (fst (tr i) n)
         else fst (tr i) n, 
         snd (tr i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
In msg (out_messages (fst (tr i) n))
tr: GTrace
n: node
H_part: is_member n participants = true
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
IH_prot: In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
b_height (get_block msg) >= b_height (get_block msg')
        simpl in H_in.tr: GTrace
n: node
H_part: is_member n participants = true
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg
  (out_messages
     (if is_member n participants
      then flip_timeout (fst (tr i) n)
      else fst (tr i) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
In msg (out_messages (fst (tr i) n))
tr: GTrace
n: node
H_part: is_member n participants = true
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
IH_prot: In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
b_height (get_block msg) >= b_height (get_block msg') 
        rewrite H_part in H_in.tr: GTrace
n: node
H_part: is_member n participants = true
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg
  (out_messages (flip_timeout (fst (tr i) n)))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
In msg (out_messages (fst (tr i) n))
tr: GTrace
n: node
H_part: is_member n participants = true
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
IH_prot: In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
b_height (get_block msg) >= b_height (get_block msg') 
        assumption.tr: GTrace
n: node
H_part: is_member n participants = true
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
IH_prot: In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
b_height (get_block msg) >= b_height (get_block msg')
        spec IH_prot.tr: GTrace
n: node
H_part: is_member n participants = true
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
IH_prot: In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
In msg' (out_messages (fst (tr i) n))
tr: GTrace
n: node
H_part: is_member n participants = true
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
IH_prot: b_height (get_block msg) >=
b_height (get_block msg')
b_height (get_block msg) >= b_height (get_block msg')
        rewrite H_timeout in H_in'.tr: GTrace
n: node
H_part: is_member n participants = true
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg'
  (out_messages
     (fst
        (fun n : node =>
         if is_member n participants
         then flip_timeout (fst (tr i) n)
         else fst (tr i) n, 
         snd (tr i)) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
IH_prot: In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
In msg' (out_messages (fst (tr i) n))
tr: GTrace
n: node
H_part: is_member n participants = true
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
IH_prot: b_height (get_block msg) >=
b_height (get_block msg')
b_height (get_block msg) >= b_height (get_block msg')
        simpl in H_in'.tr: GTrace
n: node
H_part: is_member n participants = true
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg'
  (out_messages
     (if is_member n participants
      then flip_timeout (fst (tr i) n)
      else fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
IH_prot: In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
In msg' (out_messages (fst (tr i) n))
tr: GTrace
n: node
H_part: is_member n participants = true
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
IH_prot: b_height (get_block msg) >=
b_height (get_block msg')
b_height (get_block msg) >= b_height (get_block msg')
        rewrite H_part in H_in'.tr: GTrace
n: node
H_part: is_member n participants = true
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg'
  (out_messages (flip_timeout (fst (tr i) n)))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
IH_prot: In msg' (out_messages (fst (tr i) n)) ->
b_height (get_block msg) >=
b_height (get_block msg')
In msg' (out_messages (fst (tr i) n))
tr: GTrace
n: node
H_part: is_member n participants = true
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
IH_prot: b_height (get_block msg) >=
b_height (get_block msg')
b_height (get_block msg) >= b_height (get_block msg')
        assumption.tr: GTrace
n: node
H_part: is_member n participants = true
i, p: nat
msg: message
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (out_messages (fst (tr (S i)) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
IH_prot: b_height (get_block msg) >=
b_height (get_block msg')
b_height (get_block msg) >= b_height (get_block msg') assumption.
Qed.

The sender of all PrepareBlock messages in a view is the block proposer of that view:

Lemma PrepareBlock_sender_is_new_proposer_local :
  forall (tr : GTrace) (i p : nat) (n : node) (msg : message),
  protocol_trace tr ->
  In n participants ->
  get_message_type msg = PrepareBlock ->
  get_view msg = p ->
  In msg (out_messages (fst (tr i) n)) ->
  is_block_proposer n p.forall (tr : GTrace) (i p : nat) (n : node)
  (msg : message),
protocol_trace tr ->
In n participants ->
get_message_type msg = PrepareBlock ->
get_view msg = p ->
In msg (out_messages (fst (tr i) n)) ->
is_block_proposer n p
Proof.forall (tr : GTrace) (i p : nat) (n : node)
  (msg : message),
protocol_trace tr ->
In n participants ->
get_message_type msg = PrepareBlock ->
get_view msg = p ->
In msg (out_messages (fst (tr i) n)) ->
is_block_proposer n p
  intros tr i p n msg H_prot H_part H_type H_view H_in.tr: GTrace
i, p: nat
n: node
msg: message
H_prot: protocol_trace tr
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr i) n))
is_block_proposer n p
  induction i as [|i IH_prot].tr: GTrace
p: nat
n: node
msg: message
H_prot: protocol_trace tr
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr 0) n))
is_block_proposer n p
tr: GTrace
i, p: nat
n: node
msg: message
H_prot: protocol_trace tr
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
is_block_proposer n p
is_block_proposer n p 
  -tr: GTrace
p: nat
n: node
msg: message
H_prot: protocol_trace tr
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr 0) n))
is_block_proposer n p destruct H_prot as [H_init _];
      rewrite H_init in H_in;
      inversion H_in.
  -tr: GTrace
i, p: nat
n: node
msg: message
H_prot: protocol_trace tr
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
is_block_proposer n p
is_block_proposer n p destruct (In_dec message_eq_dec msg (out_messages (fst (tr i) n))) as [H_old | H_new].tr: GTrace
i, p: nat
n: node
msg: message
H_prot: protocol_trace tr
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
is_block_proposer n p
H_old: In msg (out_messages (fst (tr i) n))
is_block_proposer n p
tr: GTrace
i, p: nat
n: node
msg: message
H_prot: protocol_trace tr
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
is_block_proposer n p
H_new: ~ In msg (out_messages (fst (tr i) n))
is_block_proposer n p
    +tr: GTrace
i, p: nat
n: node
msg: message
H_prot: protocol_trace tr
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
is_block_proposer n p
H_old: In msg (out_messages (fst (tr i) n))
is_block_proposer n p now spec IH_prot H_old.
    +tr: GTrace
i, p: nat
n: node
msg: message
H_prot: protocol_trace tr
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
IH_prot: In msg (out_messages (fst (tr i) n)) ->
is_block_proposer n p
H_new: ~ In msg (out_messages (fst (tr i) n))
is_block_proposer n p clear IH_prot.tr: GTrace
i, p: nat
n: node
msg: message
H_prot: protocol_trace tr
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_new: ~ In msg (out_messages (fst (tr i) n))
is_block_proposer n p
      assert (H_prot_copy := H_prot); 
        destruct H_prot as [_ H_prot];
        spec H_prot i;
        destruct H_prot as [[n0 [H_in0 [p0 [msg0 [lm0 [H_step H_deliver]]]]]] | H_timeout].tr: GTrace
i, p: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
is_block_proposer n p
tr: GTrace
i, p: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
is_block_proposer n p
    * (* In the normal transition case *)tr: GTrace
i, p: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
is_block_proposer n p
      assert (n0 = n).tr: GTrace
i, p: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
n0 = n
tr: GTrace
i, p: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H: n0 = n
is_block_proposer n p
      apply out_message_change_tells_sender with tr i p0 msg0 lm0; try assumption.tr: GTrace
i, p: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
exists msg : message,
  In msg (out_messages (fst (tr (S i)) n)) /\
  ~ In msg (out_messages (fst (tr i) n))
tr: GTrace
i, p: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H: n0 = n
is_block_proposer n p
      exists msg; tauto.tr: GTrace
i, p: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H: n0 = n
is_block_proposer n p
      subst.tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
H_in: In msg (out_messages (fst (tr (S i)) n))
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
p0: NState_transition_type
msg0: message
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_step: get_transition p0 (fst (tr i) n) msg0
  (fst (tr (S i)) n) lm0
is_block_proposer n (get_view msg)
      (* Case analysis on the transition *)
      destruct p0;
        assert (H_step_copy := H_step); 
        destruct H_step as [H_update [H_out H_rest]];
        rewrite H_update in H_in;
        simpl in H_in;
        (* In all the cases that don't send messages *) 
        try contradiction;
      (* In the cases that do send messages *)
        try assert (H_view_eq : view_valid (fst (tr i) (get_sender msg)) msg0) by tauto;
        try (rewrite H_view_eq in H_rest;
             rewrite (protocol_trace_state_sane H_prot_copy) in H_rest;
             assumption);
        try apply in_app_iff in H_in; 
        try repeat destruct H_in as [H_in | H_in];
        try contradiction; 
        try (apply pending_PrepareVote_correct in H_in; rewrite H_type in H_in; easy);
        try (rewrite <- H_in in H_type;
             discriminate);
        try (subst;
             rewrite H_view in H_rest;
             rewrite (protocol_trace_state_sane H_prot_copy) in H_rest; 
             easy);
        try (rewrite (protocol_trace_state_sane H_prot_copy) in H_rest;
             destruct H_rest as [H_init H_rest];
             rewrite H_init in H_in; simpl in H_in;
             rewrite <- H_in in H_view; simpl in H_view;
             subst; tauto);
        try (destruct H_rest as [H_init H_rest];
             rewrite H_init in H_in;
             simpl in H_in;
             subst; simpl;
             rewrite (protocol_trace_state_sane H_prot_copy) in H_rest; tauto).tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: In msg
  (pending_PrepareVote (fst (tr i) n) msg0 ++
   out_messages (fst (tr i) n))
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_new_block (get_block msg0);
  get_piggyback_block := get_block msg0
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (fst (tr i) n) msg0))
  (make_PrepareBlocks
     (increment_view
        (process (fst (tr i) n) msg0)) msg0)
H_out: lm0 =
make_PrepareBlocks
  (increment_view
     (process (fst (tr i) n) msg0)) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
last_block (get_block msg0) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_PrepareQC_last_block_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_new_block
      (generate_new_block (get_block msg0));
  get_piggyback_block := get_block msg0
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (fst (tr i) n) msg0))
  (make_PrepareBlocks
     (increment_view
        (process (fst (tr i) n) msg0)) msg0)
H_out: lm0 =
make_PrepareBlocks
  (increment_view
     (process (fst (tr i) n) msg0)) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
last_block (get_block msg0) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_PrepareQC_last_block_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_last_block
      (generate_new_block
         (generate_new_block (get_block msg0)));
  get_piggyback_block := get_block msg0
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (fst (tr i) n) msg0))
  (make_PrepareBlocks
     (increment_view
        (process (fst (tr i) n) msg0)) msg0)
H_out: lm0 =
make_PrepareBlocks
  (increment_view
     (process (fst (tr i) n) msg0)) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
last_block (get_block msg0) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_PrepareQC_last_block_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_new_block
      (get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0)));
  get_piggyback_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0))
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_new_block
      (generate_new_block
         (get_block
            (highest_ViewChange_message
               (process (fst (tr i) n) msg0))));
  get_piggyback_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0))
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_last_block
      (generate_new_block
         (generate_new_block
            (get_block
               (highest_ViewChange_message
                  (process (fst (tr i) n) msg0)))));
  get_piggyback_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0))
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
      apply in_app_iff in H_in;
        destruct H_in as [H_in | H_in];
        try contradiction.tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: In msg
  (pending_PrepareVote (fst (tr i) n) msg0)
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
process
  (record_plural (fst (tr i) n)
     (make_PrepareQC (fst (tr i) n) msg0
      :: pending_PrepareVote 
           (fst (tr i) n) msg0)) msg0
H_out: lm0 =
make_PrepareQC (fst (tr i) n) msg0
:: pending_PrepareVote (fst (tr i) n) msg0
H_rest: honest_node (node_id (fst (tr i) n)) /\
received (fst (tr i) n) msg0 /\
get_message_type msg0 = PrepareVote /\
view_valid (fst (tr i) n) msg0 /\
timeout (fst (tr i) n) = false /\
~
exists_same_height_block 
  (fst (tr i) n) (get_block msg0) /\
vote_quorum_in_view
  (process (fst (tr i) n) msg0)
  (get_view msg0) (get_block msg0)
H_step_copy: get_transition
  process_PrepareVote_vote_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_new_block (get_block msg0);
  get_piggyback_block := get_block msg0
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (fst (tr i) n) msg0))
  (make_PrepareBlocks
     (increment_view
        (process (fst (tr i) n) msg0)) msg0)
H_out: lm0 =
make_PrepareBlocks
  (increment_view
     (process (fst (tr i) n) msg0)) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
last_block (get_block msg0) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_PrepareQC_last_block_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_new_block
      (generate_new_block (get_block msg0));
  get_piggyback_block := get_block msg0
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (fst (tr i) n) msg0))
  (make_PrepareBlocks
     (increment_view
        (process (fst (tr i) n) msg0)) msg0)
H_out: lm0 =
make_PrepareBlocks
  (increment_view
     (process (fst (tr i) n) msg0)) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
last_block (get_block msg0) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_PrepareQC_last_block_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_last_block
      (generate_new_block
         (generate_new_block (get_block msg0)));
  get_piggyback_block := get_block msg0
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (fst (tr i) n) msg0))
  (make_PrepareBlocks
     (increment_view
        (process (fst (tr i) n) msg0)) msg0)
H_out: lm0 =
make_PrepareBlocks
  (increment_view
     (process (fst (tr i) n) msg0)) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
last_block (get_block msg0) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_PrepareQC_last_block_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_new_block
      (get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0)));
  get_piggyback_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0))
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_new_block
      (generate_new_block
         (get_block
            (highest_ViewChange_message
               (process (fst (tr i) n) msg0))));
  get_piggyback_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0))
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_last_block
      (generate_new_block
         (generate_new_block
            (get_block
               (highest_ViewChange_message
                  (process (fst (tr i) n) msg0)))));
  get_piggyback_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0))
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
      apply pending_PrepareVote_correct in H_in;
        rewrite H_type in H_in;
        easy.tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_new_block (get_block msg0);
  get_piggyback_block := get_block msg0
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (fst (tr i) n) msg0))
  (make_PrepareBlocks
     (increment_view
        (process (fst (tr i) n) msg0)) msg0)
H_out: lm0 =
make_PrepareBlocks
  (increment_view
     (process (fst (tr i) n) msg0)) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
last_block (get_block msg0) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_PrepareQC_last_block_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_new_block
      (generate_new_block (get_block msg0));
  get_piggyback_block := get_block msg0
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (fst (tr i) n) msg0))
  (make_PrepareBlocks
     (increment_view
        (process (fst (tr i) n) msg0)) msg0)
H_out: lm0 =
make_PrepareBlocks
  (increment_view
     (process (fst (tr i) n) msg0)) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
last_block (get_block msg0) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_PrepareQC_last_block_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_last_block
      (generate_new_block
         (generate_new_block (get_block msg0)));
  get_piggyback_block := get_block msg0
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (fst (tr i) n) msg0))
  (make_PrepareBlocks
     (increment_view
        (process (fst (tr i) n) msg0)) msg0)
H_out: lm0 =
make_PrepareBlocks
  (increment_view
     (process (fst (tr i) n) msg0)) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
last_block (get_block msg0) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_PrepareQC_last_block_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_new_block
      (get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0)));
  get_piggyback_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0))
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_new_block
      (generate_new_block
         (get_block
            (highest_ViewChange_message
               (process (fst (tr i) n) msg0))));
  get_piggyback_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0))
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_last_block
      (generate_new_block
         (generate_new_block
            (get_block
               (highest_ViewChange_message
                  (process (fst (tr i) n) msg0)))));
  get_piggyback_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0))
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg) 
      rewrite <- H_in; simpl;
        rewrite (protocol_trace_state_sane H_prot_copy) in H_rest;
        tauto.tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_new_block
      (generate_new_block (get_block msg0));
  get_piggyback_block := get_block msg0
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (fst (tr i) n) msg0))
  (make_PrepareBlocks
     (increment_view
        (process (fst (tr i) n) msg0)) msg0)
H_out: lm0 =
make_PrepareBlocks
  (increment_view
     (process (fst (tr i) n) msg0)) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
last_block (get_block msg0) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_PrepareQC_last_block_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_last_block
      (generate_new_block
         (generate_new_block (get_block msg0)));
  get_piggyback_block := get_block msg0
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (fst (tr i) n) msg0))
  (make_PrepareBlocks
     (increment_view
        (process (fst (tr i) n) msg0)) msg0)
H_out: lm0 =
make_PrepareBlocks
  (increment_view
     (process (fst (tr i) n) msg0)) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
last_block (get_block msg0) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_PrepareQC_last_block_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_new_block
      (get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0)));
  get_piggyback_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0))
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_new_block
      (generate_new_block
         (get_block
            (highest_ViewChange_message
               (process (fst (tr i) n) msg0))));
  get_piggyback_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0))
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_last_block
      (generate_new_block
         (generate_new_block
            (get_block
               (highest_ViewChange_message
                  (process (fst (tr i) n) msg0)))));
  get_piggyback_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0))
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg) 

      rewrite <- H_in; simpl;
        rewrite (protocol_trace_state_sane H_prot_copy) in H_rest;
        tauto.tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_last_block
      (generate_new_block
         (generate_new_block (get_block msg0)));
  get_piggyback_block := get_block msg0
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (fst (tr i) n) msg0))
  (make_PrepareBlocks
     (increment_view
        (process (fst (tr i) n) msg0)) msg0)
H_out: lm0 =
make_PrepareBlocks
  (increment_view
     (process (fst (tr i) n) msg0)) msg0
H_rest: received (fst (tr i) n) msg0 /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = PrepareQC /\
view_valid (fst (tr i) n) msg0 /\
last_block (get_block msg0) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_PrepareQC_last_block_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_new_block
      (get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0)));
  get_piggyback_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0))
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_new_block
      (generate_new_block
         (get_block
            (highest_ViewChange_message
               (process (fst (tr i) n) msg0))));
  get_piggyback_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0))
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_last_block
      (generate_new_block
         (generate_new_block
            (get_block
               (highest_ViewChange_message
                  (process (fst (tr i) n) msg0)))));
  get_piggyback_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0))
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
      rewrite <- H_in; simpl;
        rewrite (protocol_trace_state_sane H_prot_copy) in H_rest;
        tauto.tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_new_block
      (get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0)));
  get_piggyback_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0))
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_new_block
      (generate_new_block
         (get_block
            (highest_ViewChange_message
               (process (fst (tr i) n) msg0))));
  get_piggyback_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0))
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_last_block
      (generate_new_block
         (generate_new_block
            (get_block
               (highest_ViewChange_message
                  (process (fst (tr i) n) msg0)))));
  get_piggyback_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0))
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
      rewrite <- H_in; simpl;
        rewrite (protocol_trace_state_sane H_prot_copy) in H_rest;
        tauto.tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_new_block
      (generate_new_block
         (get_block
            (highest_ViewChange_message
               (process (fst (tr i) n) msg0))));
  get_piggyback_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0))
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_last_block
      (generate_new_block
         (generate_new_block
            (get_block
               (highest_ViewChange_message
                  (process (fst (tr i) n) msg0)))));
  get_piggyback_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0))
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
      rewrite <- H_in; simpl;
        rewrite (protocol_trace_state_sane H_prot_copy) in H_rest;
        tauto.tr: GTrace
i: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
msg0: message
H_in: {|
  get_message_type := PrepareBlock;
  get_view := S (node_view (fst (tr i) n));
  get_sender := node_id (fst (tr i) n);
  get_block :=
    generate_last_block
      (generate_new_block
         (generate_new_block
            (get_block
               (highest_ViewChange_message
                  (process (fst (tr i) n) msg0)))));
  get_piggyback_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0))
|} = msg
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_in0: In n participants
lm0: list message
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n) (fst (tr (S i)) n) lm0
H_update: fst (tr (S i)) n =
record_plural
  (increment_view
     (process (process (fst (tr i) n) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n);
     get_sender := node_id (fst (tr i) n);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n)
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n))
           (highest_ViewChange_message
              (process (fst (tr i) n) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n);
  get_sender := node_id (fst (tr i) n);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n)
     (highest_ViewChange_message
        (process (fst (tr i) n) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n))
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0))
H_rest: received (fst (tr i) n) msg0 /\
received (fst (tr i) n)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n) msg0)
  (node_view (fst (tr i) n)) /\
is_block_proposer (node_id (fst (tr i) n))
  (S (node_view (fst (tr i) n)))
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n) msg0 (fst (tr (S i)) n)
  lm0
is_block_proposer n (get_view msg)
      rewrite <- H_in; simpl;
        rewrite (protocol_trace_state_sane H_prot_copy) in H_rest;
        tauto. 
    *tr: GTrace
i, p: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (out_messages (fst (tr (S i)) n))
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
is_block_proposer n p rewrite H_timeout in H_in.tr: GTrace
i, p: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg
  (out_messages
     (fst
        (fun n : node =>
         if is_member n participants
         then flip_timeout (fst (tr i) n)
         else fst (tr i) n, 
         snd (tr i)) n))
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
is_block_proposer n p 
      simpl in H_in.tr: GTrace
i, p: nat
n: node
msg: message
H_part: In n participants
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg
  (out_messages
     (if is_member n participants
      then flip_timeout (fst (tr i) n)
      else fst (tr i) n))
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
is_block_proposer n p 
      apply is_member_correct in H_part.tr: GTrace
i, p: nat
n: node
msg: message
H_part: is_member n participants = true
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg
  (out_messages
     (if is_member n participants
      then flip_timeout (fst (tr i) n)
      else fst (tr i) n))
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
is_block_proposer n p 
      rewrite H_part in H_in.tr: GTrace
i, p: nat
n: node
msg: message
H_part: is_member n participants = true
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg
  (out_messages (flip_timeout (fst (tr i) n)))
H_new: ~ In msg (out_messages (fst (tr i) n))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
is_block_proposer n p
      contradiction.
Qed.

Lemma PrepareBlock_sender_is_new_proposer_global :
 forall (tr : GTrace) (i p : nat) (msg : message), protocol_trace tr ->
 get_message_type msg = PrepareBlock ->
 get_view msg = p ->
 In msg (snd (tr i)) ->
 is_block_proposer (get_sender msg) p.forall (tr : GTrace) (i p : nat) (msg : message),
protocol_trace tr ->
get_message_type msg = PrepareBlock ->
get_view msg = p ->
In msg (snd (tr i)) ->
is_block_proposer (get_sender msg) p
Proof.forall (tr : GTrace) (i p : nat) (msg : message),
protocol_trace tr ->
get_message_type msg = PrepareBlock ->
get_view msg = p ->
In msg (snd (tr i)) ->
is_block_proposer (get_sender msg) p 
  intros tr i p msg H_prot H_type H_view H_in.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
is_block_proposer (get_sender msg) p
  apply PrepareBlock_sender_is_new_proposer_local with tr i msg; try assumption.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
In (get_sender msg) participants
tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
In msg (out_messages (fst (tr i) (get_sender msg)))
  now apply participation_rights_global with tr i.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
In msg (out_messages (fst (tr i) (get_sender msg)))
  apply global_local_out_if; try assumption.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
In (get_sender msg) participants
tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
In msg
  (filter
     (fun msg0 : message =>
      node_eqb (get_sender msg0) (get_sender msg))
     (snd (tr i)))
  now apply participation_rights_global with tr i.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
In msg
  (filter
     (fun msg0 : message =>
      node_eqb (get_sender msg0) (get_sender msg))
     (snd (tr i)))
  apply filter_In.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
In msg (snd (tr i)) /\
node_eqb (get_sender msg) (get_sender msg) = true  split.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
In msg (snd (tr i))
tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
node_eqb (get_sender msg) (get_sender msg) = true assumption.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
node_eqb (get_sender msg) (get_sender msg) = true
  apply node_eqb_correct; reflexivity.
Qed.

All PrepareBlock messages sent in the same view have the same sender.

Lemma PrepareBlock_sender_view_injective_global :
 forall (tr : GTrace) (i p : nat) (msg : message), protocol_trace tr ->
  get_message_type msg = PrepareBlock ->
  get_view msg = p ->
  In msg (snd (tr i)) ->
  forall (msg' : message), get_message_type msg' = PrepareBlock ->
  get_view msg' = p ->
  In msg' (snd (tr i)) ->
  get_sender msg = get_sender msg'.forall (tr : GTrace) (i p : nat) (msg : message),
protocol_trace tr ->
get_message_type msg = PrepareBlock ->
get_view msg = p ->
In msg (snd (tr i)) ->
forall msg' : message,
get_message_type msg' = PrepareBlock ->
get_view msg' = p ->
In msg' (snd (tr i)) ->
get_sender msg = get_sender msg'
Proof.forall (tr : GTrace) (i p : nat) (msg : message),
protocol_trace tr ->
get_message_type msg = PrepareBlock ->
get_view msg = p ->
In msg (snd (tr i)) ->
forall msg' : message,
get_message_type msg' = PrepareBlock ->
get_view msg' = p ->
In msg' (snd (tr i)) ->
get_sender msg = get_sender msg'
  intros tr i p msg H_prot H_type H_view H_in msg' H_type' H_view' H_in'.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
get_sender msg = get_sender msg'
  assert (H_proposer1 : is_block_proposer (get_sender msg) p) by
   now apply PrepareBlock_sender_is_new_proposer_global with tr i.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
H_proposer1: is_block_proposer (get_sender msg) p
get_sender msg = get_sender msg'
  assert (H_proposer2 : is_block_proposer (get_sender msg') p) by
   now apply PrepareBlock_sender_is_new_proposer_global with tr i.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
H_proposer1: is_block_proposer (get_sender msg) p
H_proposer2: is_block_proposer (get_sender msg') p
get_sender msg = get_sender msg'
  now apply is_new_proposer_unique with p p. 
Qed.

Any block labeled as the last block in a PrepareBlock message is higher than any other block in a PrepareBlock message in the same view:

Lemma last_block_highest_block_global :
  forall(tr : GTrace) (i p : nat) (msg : message), protocol_trace tr ->
  get_message_type msg = PrepareBlock ->
  get_view msg = p ->
  In msg (snd (tr i)) ->
  b_last (get_block msg) = true ->
  forall (msg' : message), get_message_type msg' = PrepareBlock ->
  get_view msg' = p ->
  In msg' (snd (tr i)) ->
  b_height (get_block msg) >= b_height (get_block msg').forall (tr : GTrace) (i p : nat) (msg : message),
protocol_trace tr ->
get_message_type msg = PrepareBlock ->
get_view msg = p ->
In msg (snd (tr i)) ->
b_last (get_block msg) = true ->
forall msg' : message,
get_message_type msg' = PrepareBlock ->
get_view msg' = p ->
In msg' (snd (tr i)) ->
b_height (get_block msg) >= b_height (get_block msg')
Proof.forall (tr : GTrace) (i p : nat) (msg : message),
protocol_trace tr ->
get_message_type msg = PrepareBlock ->
get_view msg = p ->
In msg (snd (tr i)) ->
b_last (get_block msg) = true ->
forall msg' : message,
get_message_type msg' = PrepareBlock ->
get_view msg' = p ->
In msg' (snd (tr i)) ->
b_height (get_block msg) >= b_height (get_block msg')
  intros tr i p msg H_prot H_type H_view H_in H_last msg' H_type' H_view' H_in'.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
b_height (get_block msg) >= b_height (get_block msg')
  assert (get_sender msg = get_sender msg') by
   now apply PrepareBlock_sender_view_injective_global with tr i p.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
H: get_sender msg = get_sender msg'
b_height (get_block msg) >= b_height (get_block msg')
  assert (H_part : In (get_sender msg) participants) by
   now apply participation_rights_global with tr i.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
H: get_sender msg = get_sender msg'
H_part: In (get_sender msg) participants
b_height (get_block msg) >= b_height (get_block msg')
  assert (In msg (out_messages (fst (tr i) (get_sender msg)))).tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
H: get_sender msg = get_sender msg'
H_part: In (get_sender msg) participants
In msg (out_messages (fst (tr i) (get_sender msg)))
tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
H: get_sender msg = get_sender msg'
H_part: In (get_sender msg) participants
H0: In msg
  (out_messages (fst (tr i) (get_sender msg)))
b_height (get_block msg) >= b_height (get_block msg')
  {tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
H: get_sender msg = get_sender msg'
H_part: In (get_sender msg) participants
In msg (out_messages (fst (tr i) (get_sender msg))) apply global_local_out_if; try assumption.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
H: get_sender msg = get_sender msg'
H_part: In (get_sender msg) participants
In msg
  (filter
     (fun msg0 : message =>
      node_eqb (get_sender msg0) (get_sender msg))
     (snd (tr i)))
    apply filter_In.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
H: get_sender msg = get_sender msg'
H_part: In (get_sender msg) participants
In msg (snd (tr i)) /\
node_eqb (get_sender msg) (get_sender msg) = true split; try assumption.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
H: get_sender msg = get_sender msg'
H_part: In (get_sender msg) participants
node_eqb (get_sender msg) (get_sender msg) = true
    apply node_eqb_refl. }tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
H: get_sender msg = get_sender msg'
H_part: In (get_sender msg) participants
H0: In msg
  (out_messages (fst (tr i) (get_sender msg)))
b_height (get_block msg) >= b_height (get_block msg')
  assert (In msg' (out_messages (fst (tr i) (get_sender msg')))).tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
H: get_sender msg = get_sender msg'
H_part: In (get_sender msg) participants
H0: In msg
  (out_messages (fst (tr i) (get_sender msg)))
In msg' (out_messages (fst (tr i) (get_sender msg')))
tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
H: get_sender msg = get_sender msg'
H_part: In (get_sender msg) participants
H0: In msg
  (out_messages (fst (tr i) (get_sender msg)))
H1: In msg'
  (out_messages (fst (tr i) (get_sender msg')))
b_height (get_block msg) >= b_height (get_block msg') 
  {tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
H: get_sender msg = get_sender msg'
H_part: In (get_sender msg) participants
H0: In msg
  (out_messages (fst (tr i) (get_sender msg)))
In msg' (out_messages (fst (tr i) (get_sender msg'))) apply global_local_out_if; try assumption.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
H: get_sender msg = get_sender msg'
H_part: In (get_sender msg) participants
H0: In msg
  (out_messages (fst (tr i) (get_sender msg)))
In (get_sender msg') participants
tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
H: get_sender msg = get_sender msg'
H_part: In (get_sender msg) participants
H0: In msg
  (out_messages (fst (tr i) (get_sender msg)))
In msg'
  (filter
     (fun msg : message =>
      node_eqb (get_sender msg) (get_sender msg'))
     (snd (tr i)))
    now rewrite <- H.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
H: get_sender msg = get_sender msg'
H_part: In (get_sender msg) participants
H0: In msg
  (out_messages (fst (tr i) (get_sender msg)))
In msg'
  (filter
     (fun msg : message =>
      node_eqb (get_sender msg) (get_sender msg'))
     (snd (tr i)))
    apply filter_In.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
H: get_sender msg = get_sender msg'
H_part: In (get_sender msg) participants
H0: In msg
  (out_messages (fst (tr i) (get_sender msg)))
In msg' (snd (tr i)) /\
node_eqb (get_sender msg') (get_sender msg') = true split; try assumption.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
H: get_sender msg = get_sender msg'
H_part: In (get_sender msg) participants
H0: In msg
  (out_messages (fst (tr i) (get_sender msg)))
node_eqb (get_sender msg') (get_sender msg') = true
    apply node_eqb_refl. }tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
H: get_sender msg = get_sender msg'
H_part: In (get_sender msg) participants
H0: In msg
  (out_messages (fst (tr i) (get_sender msg)))
H1: In msg'
  (out_messages (fst (tr i) (get_sender msg')))
b_height (get_block msg) >= b_height (get_block msg')  
  apply last_block_highest_block_sent with tr (get_sender msg) i p; try assumption.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareBlock
H_view: get_view msg = p
H_in: In msg (snd (tr i))
H_last: b_last (get_block msg) = true
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg' = p
H_in': In msg' (snd (tr i))
H: get_sender msg = get_sender msg'
H_part: In (get_sender msg) participants
H0: In msg
  (out_messages (fst (tr i) (get_sender msg)))
H1: In msg'
  (out_messages (fst (tr i) (get_sender msg')))
In msg' (out_messages (fst (tr i) (get_sender msg)))
  now rewrite H.
Qed.

Finally, we use the connection made above to show our goal:

Lemma normal_trigger_message_highest_global :
  forall tr i p msg h_max, protocol_trace tr ->
    normal_trigger_message_global tr i p msg ->
    is_max_prepare_height_in_view_global tr i h_max p ->
    b_height (get_block msg) = h_max.forall (tr : GTrace) (i p : nat) (msg : message)
  (h_max : nat),
protocol_trace tr ->
normal_trigger_message_global tr i p msg ->
is_max_prepare_height_in_view_global tr i h_max p ->
b_height (get_block msg) = h_max  
Proof.forall (tr : GTrace) (i p : nat) (msg : message)
  (h_max : nat),
protocol_trace tr ->
normal_trigger_message_global tr i p msg ->
is_max_prepare_height_in_view_global tr i h_max p ->
b_height (get_block msg) = h_max
  intros tr i p msg h_max H_prot H_trigger H_max.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_trigger: normal_trigger_message_global tr i p msg
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
b_height (get_block msg) = h_max
  destruct H_trigger as [H_type [H_view [H_last H_in]]].tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
b_height (get_block msg) = h_max  
  (* Obtaining the PrepareBlock message *)  
  assert (H_useful := PrepareQC_sent_means_PrepareBlock_sent_global).tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
H_useful: forall (tr : GTrace) (i : nat)
  (msg1 : message),
protocol_trace tr ->
In msg1 (snd (tr i)) ->
get_message_type msg1 = PrepareQC ->
exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg1 = get_view msg2 /\
  get_block msg1 = get_block msg2 /\
  In msg2 (snd (tr i))
b_height (get_block msg) = h_max
  spec H_useful tr i msg H_prot H_in H_type.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
H_useful: exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg = get_view msg2 /\
  get_block msg = get_block msg2 /\
  In msg2 (snd (tr i))
b_height (get_block msg) = h_max
  destruct H_useful as [msg' [H_type' [H_view' [H_block' H_in']]]].tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
b_height (get_block msg) = h_max 
  (* (get_block msg) is the highest in the view *) 
  assert (H_useful := last_block_highest_block_global).tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: forall (tr : GTrace) (i p : nat)
  (msg : message),
protocol_trace tr ->
get_message_type msg = PrepareBlock ->
get_view msg = p ->
In msg (snd (tr i)) ->
b_last (get_block msg) = true ->
forall msg' : message,
get_message_type msg' = PrepareBlock ->
get_view msg' = p ->
In msg' (snd (tr i)) ->
b_height (get_block msg) >=
b_height (get_block msg')
b_height (get_block msg) = h_max 
  spec H_useful tr i p msg' H_prot H_type'.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: get_view msg' = p ->
In msg' (snd (tr i)) ->
b_last (get_block msg') = true ->
forall msg'0 : message,
get_message_type msg'0 = PrepareBlock ->
get_view msg'0 = p ->
In msg'0 (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg'0)
b_height (get_block msg) = h_max
  spec H_useful.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: get_view msg' = p ->
In msg' (snd (tr i)) ->
b_last (get_block msg') = true ->
forall msg'0 : message,
get_message_type msg'0 = PrepareBlock ->
get_view msg'0 = p ->
In msg'0 (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg'0)
get_view msg' = p
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: In msg' (snd (tr i)) ->
b_last (get_block msg') = true ->
forall msg'0 : message,
get_message_type msg'0 = PrepareBlock ->
get_view msg'0 = p ->
In msg'0 (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg'0)
b_height (get_block msg) = h_max firstorder lia.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: In msg' (snd (tr i)) ->
b_last (get_block msg') = true ->
forall msg'0 : message,
get_message_type msg'0 = PrepareBlock ->
get_view msg'0 = p ->
In msg'0 (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg'0)
b_height (get_block msg) = h_max
  spec H_useful H_in'.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_last (get_block msg') = true ->
forall msg'0 : message,
get_message_type msg'0 = PrepareBlock ->
get_view msg'0 = p ->
In msg'0 (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg'0)
b_height (get_block msg) = h_max
  spec H_useful.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_last (get_block msg') = true ->
forall msg'0 : message,
get_message_type msg'0 = PrepareBlock ->
get_view msg'0 = p ->
In msg'0 (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg'0)
b_last (get_block msg') = true
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: forall msg'0 : message,
get_message_type msg'0 = PrepareBlock ->
get_view msg'0 = p ->
In msg'0 (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg'0)
b_height (get_block msg) = h_max
  rewrite <- H_block'; assumption.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: forall msg'0 : message,
get_message_type msg'0 = PrepareBlock ->
get_view msg'0 = p ->
In msg'0 (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg'0)
b_height (get_block msg) = h_max
  rewrite H_block'.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: forall msg'0 : message,
get_message_type msg'0 = PrepareBlock ->
get_view msg'0 = p ->
In msg'0 (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg'0)
b_height (get_block msg') = h_max
  (* Now the message we want to feed it is the max prepare height message *)
  destruct H_max as [H_exists H_max].tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
H_exists: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h_max
H_max: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: forall msg'0 : message,
get_message_type msg'0 = PrepareBlock ->
get_view msg'0 = p ->
In msg'0 (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg'0)
b_height (get_block msg') = h_max
  destruct H_exists as [b [H_prepare H_height]].tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
H_prepare: prepare_stage_in_view_global tr i b p
H_height: b_height b = h_max
H_max: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: forall msg'0 : message,
get_message_type msg'0 = PrepareBlock ->
get_view msg'0 = p ->
In msg'0 (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg'0)
b_height (get_block msg') = h_max
  apply prepare_means_PrepareVote_PrepareQC_exists_global in H_prepare; try assumption.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
H_prepare: exists msg1 : message,
  In msg1 (snd (tr i)) /\
  get_view msg1 = p /\
  get_block msg1 = b /\
  (get_message_type msg1 = PrepareVote \/
   get_message_type msg1 = PrepareQC)
H_height: b_height b = h_max
H_max: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: forall msg'0 : message,
get_message_type msg'0 = PrepareBlock ->
get_view msg'0 = p ->
In msg'0 (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg'0)
b_height (get_block msg') = h_max 
  destruct H_prepare as [msg0 [H_in0 [H_view0 [H_block0 [H_type_left | H_type_right]]]]].tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
H_type_left: get_message_type msg0 = PrepareVote
H_height: b_height b = h_max
H_max: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: forall msg'0 : message,
get_message_type msg'0 = PrepareBlock ->
get_view msg'0 = p ->
In msg'0 (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg'0)
b_height (get_block msg') = h_max
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
H_type_right: get_message_type msg0 = PrepareQC
H_height: b_height b = h_max
H_max: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: forall msg'0 : message,
get_message_type msg'0 = PrepareBlock ->
get_view msg'0 = p ->
In msg'0 (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg'0)
b_height (get_block msg') = h_max
  - (* In the case that the Prepare message is a PrepareVote *)tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
H_type_left: get_message_type msg0 = PrepareVote
H_height: b_height b = h_max
H_max: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: forall msg'0 : message,
get_message_type msg'0 = PrepareBlock ->
get_view msg'0 = p ->
In msg'0 (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg'0)
b_height (get_block msg') = h_max
    apply PrepareVote_sent_means_PrepareBlock_sent_global
     with tr i _ in H_type_left; try assumption.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
H_type_left: exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg0 = get_view msg2 /\
  get_block msg0 = get_block msg2 /\
  In msg2 (snd (tr i))
H_height: b_height b = h_max
H_max: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: forall msg'0 : message,
get_message_type msg'0 = PrepareBlock ->
get_view msg'0 = p ->
In msg'0 (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg'0)
b_height (get_block msg') = h_max 
    destruct H_type_left as [msg0_pb [H_type0_pb [H_view0_pb [H_block0_pb H_in0_pb]]]].tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
H_max: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: forall msg'0 : message,
get_message_type msg'0 = PrepareBlock ->
get_view msg'0 = p ->
In msg'0 (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg'0)
b_height (get_block msg') = h_max
    spec H_useful msg0_pb H_type0_pb.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
H_max: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: get_view msg0_pb = p ->
In msg0_pb (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg0_pb)
b_height (get_block msg') = h_max
    spec H_useful.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
H_max: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: get_view msg0_pb = p ->
In msg0_pb (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg0_pb)
get_view msg0_pb = p
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
H_max: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: In msg0_pb (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg0_pb)
b_height (get_block msg') = h_max firstorder lia.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
H_max: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: In msg0_pb (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg0_pb)
b_height (get_block msg') = h_max
    spec H_useful H_in0_pb.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
H_max: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_height (get_block msg') >=
b_height (get_block msg0_pb)
b_height (get_block msg') = h_max
    spec H_max (get_block msg').tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_height (get_block msg') >=
b_height (get_block msg0_pb)
H_max: prepare_stage_in_view_global tr i
  (get_block msg') p ->
b_height (get_block msg') <= h_max
b_height (get_block msg') = h_max
    spec H_max.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_height (get_block msg') >=
b_height (get_block msg0_pb)
H_max: prepare_stage_in_view_global tr i
  (get_block msg') p ->
b_height (get_block msg') <= h_max
prepare_stage_in_view_global tr i (get_block msg') p
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_height (get_block msg') >=
b_height (get_block msg0_pb)
H_max: b_height (get_block msg') <= h_max
b_height (get_block msg') = h_max
    right.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_height (get_block msg') >=
b_height (get_block msg0_pb)
H_max: prepare_stage_in_view_global tr i
  (get_block msg') p ->
b_height (get_block msg') <= h_max
PrepareQC_in_view_global tr i (get_block msg') p
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_height (get_block msg') >=
b_height (get_block msg0_pb)
H_max: b_height (get_block msg') <= h_max
b_height (get_block msg') = h_max exists msg.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_height (get_block msg') >=
b_height (get_block msg0_pb)
H_max: prepare_stage_in_view_global tr i
  (get_block msg') p ->
b_height (get_block msg') <= h_max
In msg (snd (tr i)) /\
get_view msg = p /\
get_block msg = get_block msg' /\
get_message_type msg = PrepareQC
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_height (get_block msg') >=
b_height (get_block msg0_pb)
H_max: b_height (get_block msg') <= h_max
b_height (get_block msg') = h_max repeat split; try assumption.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_height (get_block msg') >=
b_height (get_block msg0_pb)
H_max: b_height (get_block msg') <= h_max
b_height (get_block msg') = h_max
    rewrite H_block0 in H_block0_pb.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: b = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_height (get_block msg') >=
b_height (get_block msg0_pb)
H_max: b_height (get_block msg') <= h_max
b_height (get_block msg') = h_max
    rewrite <- H_block0_pb in H_useful.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: b = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_height (get_block msg') >= b_height b
H_max: b_height (get_block msg') <= h_max
b_height (get_block msg') = h_max
    lia. 
  -tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
H_type_right: get_message_type msg0 = PrepareQC
H_height: b_height b = h_max
H_max: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: forall msg'0 : message,
get_message_type msg'0 = PrepareBlock ->
get_view msg'0 = p ->
In msg'0 (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg'0)
b_height (get_block msg') = h_max apply PrepareQC_sent_means_PrepareBlock_sent_global
      with tr i _ in H_type_right; try assumption.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
H_type_right: exists msg2 : message,
  get_message_type msg2 = PrepareBlock /\
  get_view msg0 = get_view msg2 /\
  get_block msg0 = get_block msg2 /\
  In msg2 (snd (tr i))
H_height: b_height b = h_max
H_max: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: forall msg'0 : message,
get_message_type msg'0 = PrepareBlock ->
get_view msg'0 = p ->
In msg'0 (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg'0)
b_height (get_block msg') = h_max
    destruct H_type_right as [msg0_pb [H_type0_pb [H_view0_pb [H_block0_pb H_in0_pb]]]].tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
H_max: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: forall msg'0 : message,
get_message_type msg'0 = PrepareBlock ->
get_view msg'0 = p ->
In msg'0 (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg'0)
b_height (get_block msg') = h_max
    spec H_useful msg0_pb H_type0_pb.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
H_max: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: get_view msg0_pb = p ->
In msg0_pb (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg0_pb)
b_height (get_block msg') = h_max
    spec H_useful.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
H_max: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: get_view msg0_pb = p ->
In msg0_pb (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg0_pb)
get_view msg0_pb = p
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
H_max: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: In msg0_pb (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg0_pb)
b_height (get_block msg') = h_max firstorder lia.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
H_max: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: In msg0_pb (snd (tr i)) ->
b_height (get_block msg') >=
b_height (get_block msg0_pb)
b_height (get_block msg') = h_max
    spec H_useful H_in0_pb.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
H_max: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_height (get_block msg') >=
b_height (get_block msg0_pb)
b_height (get_block msg') = h_max
    spec H_max (get_block msg').tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_height (get_block msg') >=
b_height (get_block msg0_pb)
H_max: prepare_stage_in_view_global tr i
  (get_block msg') p ->
b_height (get_block msg') <= h_max
b_height (get_block msg') = h_max
    spec H_max.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_height (get_block msg') >=
b_height (get_block msg0_pb)
H_max: prepare_stage_in_view_global tr i
  (get_block msg') p ->
b_height (get_block msg') <= h_max
prepare_stage_in_view_global tr i (get_block msg') p
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_height (get_block msg') >=
b_height (get_block msg0_pb)
H_max: b_height (get_block msg') <= h_max
b_height (get_block msg') = h_max
    right.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_height (get_block msg') >=
b_height (get_block msg0_pb)
H_max: prepare_stage_in_view_global tr i
  (get_block msg') p ->
b_height (get_block msg') <= h_max
PrepareQC_in_view_global tr i (get_block msg') p
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_height (get_block msg') >=
b_height (get_block msg0_pb)
H_max: b_height (get_block msg') <= h_max
b_height (get_block msg') = h_max exists msg.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_height (get_block msg') >=
b_height (get_block msg0_pb)
H_max: prepare_stage_in_view_global tr i
  (get_block msg') p ->
b_height (get_block msg') <= h_max
In msg (snd (tr i)) /\
get_view msg = p /\
get_block msg = get_block msg' /\
get_message_type msg = PrepareQC
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_height (get_block msg') >=
b_height (get_block msg0_pb)
H_max: b_height (get_block msg') <= h_max
b_height (get_block msg') = h_max repeat split; try assumption.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: get_block msg0 = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_height (get_block msg') >=
b_height (get_block msg0_pb)
H_max: b_height (get_block msg') <= h_max
b_height (get_block msg') = h_max
    rewrite H_block0 in H_block0_pb.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: b = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_height (get_block msg') >=
b_height (get_block msg0_pb)
H_max: b_height (get_block msg') <= h_max
b_height (get_block msg') = h_max
    rewrite <- H_block0_pb in H_useful.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = p
H_last: b_last (get_block msg) = true
H_in: In msg (snd (tr i))
b: block
msg0: message
H_in0: In msg0 (snd (tr i))
H_view0: get_view msg0 = p
H_block0: get_block msg0 = b
msg0_pb: message
H_type0_pb: get_message_type msg0_pb = PrepareBlock
H_view0_pb: get_view msg0 = get_view msg0_pb
H_block0_pb: b = get_block msg0_pb
H_in0_pb: In msg0_pb (snd (tr i))
H_height: b_height b = h_max
msg': message
H_type': get_message_type msg' = PrepareBlock
H_view': get_view msg = get_view msg'
H_block': get_block msg = get_block msg'
H_in': In msg' (snd (tr i))
H_useful: b_height (get_block msg') >= b_height b
H_max: b_height (get_block msg') <= h_max
b_height (get_block msg') = h_max
    lia.
Qed.

Timeout trigger message contains highest or second highest block

Next, we prove the height property for timeout trigger messages.

The proof in this case is slightly more complex. The timeout trigger message is a ViewChangeQC message aggregated from quorum ViewChange messages, containing the highest block computed from all the ViewChange messages. We call this block the max height block. Let b' be the highest prepare stage block globally, meaning that there exists at least one node n such that b' is in prepare stage locally. Let b'' be the parent of b'. Because b' is in highest prepare stage globally, there must be at least quorum nodes for whom b'' is in prepare stage locally. Because ViewChange messages contain the locally highest prepare stage block, and the locally highest prepare stage block is at least b'' for majority nodes, any quorum of ViewChange messages' max height block must be at least b''.

The global maximum prepare height is either the highest or second highest:

Lemma is_max_prepare_height_in_view_disj_global :
  forall tr i h p, protocol_trace tr ->
    is_max_prepare_height_in_view_global tr i h p ->
    forall b, prepare_stage_in_view_global tr i b p ->
      b_height b = h \/ b_height b < h.forall (tr : GTrace) (i h p : nat),
protocol_trace tr ->
is_max_prepare_height_in_view_global tr i h p ->
forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b = h \/ b_height b < h
Proof.forall (tr : GTrace) (i h p : nat),
protocol_trace tr ->
is_max_prepare_height_in_view_global tr i h p ->
forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b = h \/ b_height b < h
  intros tr i h p H_prot H_highest b H_prepare.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_highest: is_max_prepare_height_in_view_global tr i
  h p
b: block
H_prepare: prepare_stage_in_view_global tr i b p
b_height b = h \/ b_height b < h
  destruct (classic (is_max_prepare_height_in_view_global tr i (b_height b) p)) as [H_yes | H_no].tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_highest: is_max_prepare_height_in_view_global tr i
  h p
b: block
H_prepare: prepare_stage_in_view_global tr i b p
H_yes: is_max_prepare_height_in_view_global tr i
  (b_height b) p
b_height b = h \/ b_height b < h
tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_highest: is_max_prepare_height_in_view_global tr i
  h p
b: block
H_prepare: prepare_stage_in_view_global tr i b p
H_no: ~
is_max_prepare_height_in_view_global tr i
  (b_height b) p
b_height b = h \/ b_height b < h 
  + (* If (b_height b) is the highest *)tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_highest: is_max_prepare_height_in_view_global tr i
  h p
b: block
H_prepare: prepare_stage_in_view_global tr i b p
H_yes: is_max_prepare_height_in_view_global tr i
  (b_height b) p
b_height b = h \/ b_height b < h
    left.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_highest: is_max_prepare_height_in_view_global tr i
  h p
b: block
H_prepare: prepare_stage_in_view_global tr i b p
H_yes: is_max_prepare_height_in_view_global tr i
  (b_height b) p
b_height b = h
    destruct H_highest as [H_prepare1 H_highest1].tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_prepare1: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
H_highest1: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h
b: block
H_prepare: prepare_stage_in_view_global tr i b p
H_yes: is_max_prepare_height_in_view_global tr i
  (b_height b) p
b_height b = h
    destruct H_prepare1 as [b1 [H_prepare1 H_height1]].tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
b1: block
H_prepare1: prepare_stage_in_view_global tr i b1 p
H_height1: b_height b1 = h
H_highest1: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h
b: block
H_prepare: prepare_stage_in_view_global tr i b p
H_yes: is_max_prepare_height_in_view_global tr i
  (b_height b) p
b_height b = h
    destruct H_yes as [H_prepare2 H_highest2].tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
b1: block
H_prepare1: prepare_stage_in_view_global tr i b1 p
H_height1: b_height b1 = h
H_highest1: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h
b: block
H_prepare: prepare_stage_in_view_global tr i b p
H_prepare2: exists b0 : block,
  prepare_stage_in_view_global tr i b0 p /\
  b_height b0 = b_height b
H_highest2: forall b0 : block,
prepare_stage_in_view_global tr i b0 p ->
b_height b0 <= b_height b
b_height b = h
    destruct H_prepare2 as [b2 [H_prepare2 H_height2]].tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
b1: block
H_prepare1: prepare_stage_in_view_global tr i b1 p
H_height1: b_height b1 = h
H_highest1: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h
b: block
H_prepare: prepare_stage_in_view_global tr i b p
b2: block
H_prepare2: prepare_stage_in_view_global tr i b2 p
H_height2: b_height b2 = b_height b
H_highest2: forall b0 : block,
prepare_stage_in_view_global tr i b0 p ->
b_height b0 <= b_height b
b_height b = h
    spec H_highest1 b2 H_prepare2.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
b1: block
H_prepare1: prepare_stage_in_view_global tr i b1 p
H_height1: b_height b1 = h
b: block
H_prepare: prepare_stage_in_view_global tr i b p
b2: block
H_prepare2: prepare_stage_in_view_global tr i b2 p
H_height2: b_height b2 = b_height b
H_highest2: forall b0 : block,
prepare_stage_in_view_global tr i b0 p ->
b_height b0 <= b_height b
H_highest1: b_height b2 <= h
b_height b = h
    spec H_highest2 b1 H_prepare1.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
b1: block
H_prepare1: prepare_stage_in_view_global tr i b1 p
H_height1: b_height b1 = h
b: block
H_prepare: prepare_stage_in_view_global tr i b p
b2: block
H_prepare2: prepare_stage_in_view_global tr i b2 p
H_height2: b_height b2 = b_height b
H_highest1: b_height b2 <= h
H_highest2: b_height b1 <= b_height b
b_height b = h
    lia.
  + (* If (b_height b) is not the highest *)tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_highest: is_max_prepare_height_in_view_global tr i
  h p
b: block
H_prepare: prepare_stage_in_view_global tr i b p
H_no: ~
is_max_prepare_height_in_view_global tr i
  (b_height b) p
b_height b = h \/ b_height b < h
    destruct H_highest as [H_prepare1 H_highest1].tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
H_prepare1: exists b : block,
  prepare_stage_in_view_global tr i b p /\
  b_height b = h
H_highest1: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h
b: block
H_prepare: prepare_stage_in_view_global tr i b p
H_no: ~
is_max_prepare_height_in_view_global tr i
  (b_height b) p
b_height b = h \/ b_height b < h
    destruct H_prepare1 as [b1 [H_prepare1 H_height1]].tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
b1: block
H_prepare1: prepare_stage_in_view_global tr i b1 p
H_height1: b_height b1 = h
H_highest1: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b <= h
b: block
H_prepare: prepare_stage_in_view_global tr i b p
H_no: ~
is_max_prepare_height_in_view_global tr i
  (b_height b) p
b_height b = h \/ b_height b < h
    spec H_highest1 b H_prepare.tr: GTrace
i, h, p: nat
H_prot: protocol_trace tr
b1: block
H_prepare1: prepare_stage_in_view_global tr i b1 p
H_height1: b_height b1 = h
b: block
H_prepare: prepare_stage_in_view_global tr i b p
H_no: ~
is_max_prepare_height_in_view_global tr i
  (b_height b) p
H_highest1: b_height b <= h
b_height b = h \/ b_height b < h
    lia.
Qed.

If there exists a ViewChangeQC message in the global broadcast message buffer, then there must exist a specific quorum of ViewChange messages broadcast globally from which it was aggregated:

Lemma timeout_trigger_message_global_means_exists_ViewChange_quorum :
  forall tr i p msg, protocol_trace tr ->
    (* If msg triggered the view change from p to (S p) *) 
    timeout_trigger_message_global tr i p msg ->
    (* Then there must exist a list of ViewChange messages that are broadcast globally
       in view p, implicitly those that are processed by the new proposer *)
    exists lm,
      (forall msg, In msg lm -> In msg (filter (fun msg => Nat.eqb (get_view msg) p &&
        message_type_eqb (get_message_type msg) ViewChange) (snd (tr i)))) /\
      (* That has reached quorum *) 
      quorum lm /\
      (* That was used by the new proposer (identity irrelevant) to create the ViewChangeQC message *) 
      exists n, get_block msg = get_block (highest_message_in_list n ViewChange lm).forall (tr : GTrace) (i p : nat) (msg : message),
protocol_trace tr ->
timeout_trigger_message_global tr i p msg ->
exists lm : list message,
  (forall msg0 : message,
   In msg0 lm ->
   In msg0
     (filter
        (fun msg1 : message =>
         (get_view msg1 =? p) &&
         message_type_eqb (get_message_type msg1)
           ViewChange) (snd (tr i)))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm))
Proof.forall (tr : GTrace) (i p : nat) (msg : message),
protocol_trace tr ->
timeout_trigger_message_global tr i p msg ->
exists lm : list message,
  (forall msg0 : message,
   In msg0 lm ->
   In msg0
     (filter
        (fun msg1 : message =>
         (get_view msg1 =? p) &&
         message_type_eqb (get_message_type msg1)
           ViewChange) (snd (tr i)))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm))
  intros tr i p msg H_prot H_trigger.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: timeout_trigger_message_global tr i p msg
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb (get_message_type msg0)
           ViewChange) (snd (tr i)))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm)) 
  induction i as [|i IH_prot].tr: GTrace
p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: timeout_trigger_message_global tr 0 p msg
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr 0)))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm))
tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: timeout_trigger_message_global tr 
  (S i) p msg
IH_prot: timeout_trigger_message_global tr i p msg ->
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb
           (get_message_type msg0)
           ViewChange) (snd (tr i)))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange
          lm))
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm))
  -tr: GTrace
p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: timeout_trigger_message_global tr 0 p msg
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr 0)))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm)) destruct H_prot as [H_init _].tr: GTrace
p: nat
msg: message
H_init: tr 0 = GState_init
H_trigger: timeout_trigger_message_global tr 0 p msg
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr 0)))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm)) 
    red in H_trigger; rewrite H_init in H_trigger.tr: GTrace
p: nat
msg: message
H_init: tr 0 = GState_init
H_trigger: get_message_type msg = ViewChangeQC /\
get_view msg = p /\
In msg (snd GState_init)
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr 0)))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm))
    simpl in H_trigger.tr: GTrace
p: nat
msg: message
H_init: tr 0 = GState_init
H_trigger: get_message_type msg = ViewChangeQC /\
get_view msg = p /\ False
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr 0)))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm)) tauto.
  -tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: timeout_trigger_message_global tr 
  (S i) p msg
IH_prot: timeout_trigger_message_global tr i p msg ->
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb
           (get_message_type msg0)
           ViewChange) (snd (tr i)))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange
          lm))
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm)) destruct (timeout_trigger_message_global_dec tr i p msg) as [H_old | H_new].tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: timeout_trigger_message_global tr 
  (S i) p msg
IH_prot: timeout_trigger_message_global tr i p msg ->
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb
           (get_message_type msg0)
           ViewChange) (snd (tr i)))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange
          lm))
H_old: timeout_trigger_message_global tr i p msg
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm))
tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: timeout_trigger_message_global tr 
  (S i) p msg
IH_prot: timeout_trigger_message_global tr i p msg ->
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb
           (get_message_type msg0)
           ViewChange) (snd (tr i)))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange
          lm))
H_new: ~ timeout_trigger_message_global tr i p msg
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm))
    +tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: timeout_trigger_message_global tr 
  (S i) p msg
IH_prot: timeout_trigger_message_global tr i p msg ->
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb
           (get_message_type msg0)
           ViewChange) (snd (tr i)))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange
          lm))
H_old: timeout_trigger_message_global tr i p msg
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm)) spec IH_prot H_old.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: timeout_trigger_message_global tr 
  (S i) p msg
H_old: timeout_trigger_message_global tr i p msg
IH_prot: exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb
           (get_message_type msg0)
           ViewChange) (snd (tr i)))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange
          lm))
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm))
      destruct IH_prot as [lm [H_subset H_rest]].tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: timeout_trigger_message_global tr 
  (S i) p msg
H_old: timeout_trigger_message_global tr i p msg
lm: list message
H_subset: forall msg : message,
In msg lm ->
In msg
  (filter
     (fun msg0 : message =>
      (get_view msg0 =? p) &&
      message_type_eqb
        (get_message_type msg0) ViewChange)
     (snd (tr i)))
H_rest: quorum lm /\
(exists n : node,
   get_block msg =
   get_block
     (highest_message_in_list n ViewChange lm))
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm))
      exists lm; repeat split; try tauto.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: timeout_trigger_message_global tr 
  (S i) p msg
H_old: timeout_trigger_message_global tr i p msg
lm: list message
H_subset: forall msg : message,
In msg lm ->
In msg
  (filter
     (fun msg0 : message =>
      (get_view msg0 =? p) &&
      message_type_eqb
        (get_message_type msg0) ViewChange)
     (snd (tr i)))
H_rest: quorum lm /\
(exists n : node,
   get_block msg =
   get_block
     (highest_message_in_list n ViewChange lm))
forall msg : message,
In msg lm ->
In msg
  (filter
     (fun msg0 : message =>
      (get_view msg0 =? p) &&
      message_type_eqb (get_message_type msg0)
        ViewChange) (snd (tr (S i))))
      intros msg0 H_in0.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: timeout_trigger_message_global tr 
  (S i) p msg
H_old: timeout_trigger_message_global tr i p msg
lm: list message
H_subset: forall msg : message,
In msg lm ->
In msg
  (filter
     (fun msg0 : message =>
      (get_view msg0 =? p) &&
      message_type_eqb
        (get_message_type msg0) ViewChange)
     (snd (tr i)))
H_rest: quorum lm /\
(exists n : node,
   get_block msg =
   get_block
     (highest_message_in_list n ViewChange lm))
msg0: message
H_in0: In msg0 lm
In msg0
  (filter
     (fun msg : message =>
      (get_view msg =? p) &&
      message_type_eqb (get_message_type msg)
        ViewChange) (snd (tr (S i)))) apply filter_In.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: timeout_trigger_message_global tr 
  (S i) p msg
H_old: timeout_trigger_message_global tr i p msg
lm: list message
H_subset: forall msg : message,
In msg lm ->
In msg
  (filter
     (fun msg0 : message =>
      (get_view msg0 =? p) &&
      message_type_eqb
        (get_message_type msg0) ViewChange)
     (snd (tr i)))
H_rest: quorum lm /\
(exists n : node,
   get_block msg =
   get_block
     (highest_message_in_list n ViewChange lm))
msg0: message
H_in0: In msg0 lm
In msg0 (snd (tr (S i))) /\
(get_view msg0 =? p) &&
message_type_eqb (get_message_type msg0) ViewChange =
true
      spec H_subset msg0 H_in0.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: timeout_trigger_message_global tr 
  (S i) p msg
H_old: timeout_trigger_message_global tr i p msg
lm: list message
H_rest: quorum lm /\
(exists n : node,
   get_block msg =
   get_block
     (highest_message_in_list n ViewChange lm))
msg0: message
H_in0: In msg0 lm
H_subset: In msg0
  (filter
     (fun msg : message =>
      (get_view msg =? p) &&
      message_type_eqb
        (get_message_type msg) ViewChange)
     (snd (tr i)))
In msg0 (snd (tr (S i))) /\
(get_view msg0 =? p) &&
message_type_eqb (get_message_type msg0) ViewChange =
true 
      apply filter_In in H_subset.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: timeout_trigger_message_global tr 
  (S i) p msg
H_old: timeout_trigger_message_global tr i p msg
lm: list message
H_rest: quorum lm /\
(exists n : node,
   get_block msg =
   get_block
     (highest_message_in_list n ViewChange lm))
msg0: message
H_in0: In msg0 lm
H_subset: In msg0 (snd (tr i)) /\
(get_view msg0 =? p) &&
message_type_eqb (get_message_type msg0)
  ViewChange = true
In msg0 (snd (tr (S i))) /\
(get_view msg0 =? p) &&
message_type_eqb (get_message_type msg0) ViewChange =
true
      split.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: timeout_trigger_message_global tr 
  (S i) p msg
H_old: timeout_trigger_message_global tr i p msg
lm: list message
H_rest: quorum lm /\
(exists n : node,
   get_block msg =
   get_block
     (highest_message_in_list n ViewChange lm))
msg0: message
H_in0: In msg0 lm
H_subset: In msg0 (snd (tr i)) /\
(get_view msg0 =? p) &&
message_type_eqb (get_message_type msg0)
  ViewChange = true
In msg0 (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: timeout_trigger_message_global tr 
  (S i) p msg
H_old: timeout_trigger_message_global tr i p msg
lm: list message
H_rest: quorum lm /\
(exists n : node,
   get_block msg =
   get_block
     (highest_message_in_list n ViewChange lm))
msg0: message
H_in0: In msg0 lm
H_subset: In msg0 (snd (tr i)) /\
(get_view msg0 =? p) &&
message_type_eqb (get_message_type msg0)
  ViewChange = true
(get_view msg0 =? p) &&
message_type_eqb (get_message_type msg0) ViewChange =
true
      now apply global_messages_monotonic_step; try assumption.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: timeout_trigger_message_global tr 
  (S i) p msg
H_old: timeout_trigger_message_global tr i p msg
lm: list message
H_rest: quorum lm /\
(exists n : node,
   get_block msg =
   get_block
     (highest_message_in_list n ViewChange lm))
msg0: message
H_in0: In msg0 lm
H_subset: In msg0 (snd (tr i)) /\
(get_view msg0 =? p) &&
message_type_eqb (get_message_type msg0)
  ViewChange = true
(get_view msg0 =? p) &&
message_type_eqb (get_message_type msg0) ViewChange =
true
      tauto.
    +tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: timeout_trigger_message_global tr 
  (S i) p msg
IH_prot: timeout_trigger_message_global tr i p msg ->
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb
           (get_message_type msg0)
           ViewChange) (snd (tr i)))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange
          lm))
H_new: ~ timeout_trigger_message_global tr i p msg
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm)) clear IH_prot.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: timeout_trigger_message_global tr 
  (S i) p msg
H_new: ~ timeout_trigger_message_global tr i p msg
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm)) 
      unfold timeout_trigger_message_global in *.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: get_message_type msg = ViewChangeQC /\
get_view msg = p /\
In msg (snd (tr (S i)))
H_new: ~
(get_message_type msg = ViewChangeQC /\
 get_view msg = p /\ In msg (snd (tr i)))
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm))
      assert (~ In msg (snd (tr i))) by tauto.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: get_message_type msg = ViewChangeQC /\
get_view msg = p /\
In msg (snd (tr (S i)))
H_new: ~
(get_message_type msg = ViewChangeQC /\
 get_view msg = p /\ In msg (snd (tr i)))
H: ~ In msg (snd (tr i))
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm))
      clear H_new.tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_trigger: get_message_type msg = ViewChangeQC /\
get_view msg = p /\
In msg (snd (tr (S i)))
H: ~ In msg (snd (tr i))
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm))
      destruct H_trigger as [H_type [H_view H_in]].tr: GTrace
i, p: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
H: ~ In msg (snd (tr i))
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm))
      assert (H_prot_copy := H_prot);
        destruct H_prot as [_ H_prot];
        spec H_prot i;
        destruct H_prot as [[n0 [H_in0 [p0 [msg0 [lm0 [H_step H_deliver]]]]]] | H_timeout].tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm))
    * (* In the normal transition case *)tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
n0: node
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
lm0: list message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm)) 
      rewrite H_deliver in H_in.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
H_in: In msg
  (snd
     (broadcast_messages 
        (tr i) (fst (tr i) n0)
        (fst (tr (S i)) n0) lm0))
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm))
      simpl in H_in.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
H_in: In msg (lm0 ++ snd (tr i))
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm))
      apply in_app_iff in H_in;
        destruct H_in as [H_in | H_in];
        try contradiction.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
H_in: In msg lm0
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
p0: NState_transition_type
msg0: message
H_step: get_transition p0 (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm))
      assert (H_step_copy := H_step);
        destruct p0;
        destruct H_step as [H_update [H_out H_rest]];
        rewrite H_out in H_in;
        simpl in H_in;
        try contradiction;
        repeat destruct H_in as [H_in | H_in];
        try contradiction;
        try (rewrite <- H_in in H_type;
             simpl in H_type;
             discriminate);
        try (apply pending_PrepareVote_correct in H_in;
             rewrite H_type in H_in;
             easy).tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm))
      assert (H_quorum : view_change_quorum_in_view (process
       (fst (tr i) n0) msg0) (node_view (fst (tr i) n0))) by tauto.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0))
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm)) 
      red in H_quorum.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm))
      exists (processed_ViewChange_in_view (process (fst (tr i) n0) msg0)
       (node_view (fst (tr i) n0))); repeat split.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
forall msg : message,
In msg
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0))) ->
In msg
  (filter
     (fun msg0 : message =>
      (get_view msg0 =? p) &&
      message_type_eqb (get_message_type msg0)
        ViewChange) (snd (tr (S i))))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0))))
      (* Proving the subset relation *)
      intros msg' H_in'.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
In msg'
  (filter
     (fun msg : message =>
      (get_view msg =? p) &&
      message_type_eqb (get_message_type msg)
        ViewChange) (snd (tr (S i))))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0))))
      apply filter_In in H_in'.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0)) /\
message_type_eqb ViewChange
  (get_message_type msg') &&
(get_view msg' =? node_view (fst (tr i) n0)) =
true
In msg'
  (filter
     (fun msg : message =>
      (get_view msg =? p) &&
      message_type_eqb (get_message_type msg)
        ViewChange) (snd (tr (S i))))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0))))
      destruct H_in' as [H_in' H_rest'].tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_rest': message_type_eqb ViewChange
  (get_message_type msg') &&
(get_view msg' =? node_view (fst (tr i) n0)) =
true
In msg'
  (filter
     (fun msg : message =>
      (get_view msg =? p) &&
      message_type_eqb (get_message_type msg)
        ViewChange) (snd (tr (S i))))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0))))
      apply filter_In.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_rest': message_type_eqb ViewChange
  (get_message_type msg') &&
(get_view msg' =? node_view (fst (tr i) n0)) =
true
In msg' (snd (tr (S i))) /\
(get_view msg' =? p) &&
message_type_eqb (get_message_type msg') ViewChange =
true
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0)))) split.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_rest': message_type_eqb ViewChange
  (get_message_type msg') &&
(get_view msg' =? node_view (fst (tr i) n0)) =
true
In msg' (snd (tr (S i)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_rest': message_type_eqb ViewChange
  (get_message_type msg') &&
(get_view msg' =? node_view (fst (tr i) n0)) =
true
(get_view msg' =? p) &&
message_type_eqb (get_message_type msg') ViewChange =
true
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0))))
      apply processed_means_sent_global with n0; try assumption.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_rest': message_type_eqb ViewChange
  (get_message_type msg') &&
(get_view msg' =? node_view (fst (tr i) n0)) =
true
In msg' (counting_messages (fst (tr (S i)) n0))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_rest': message_type_eqb ViewChange
  (get_message_type msg') &&
(get_view msg' =? node_view (fst (tr i) n0)) =
true
(get_view msg' =? p) &&
message_type_eqb (get_message_type msg') ViewChange =
true
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0))))
      rewrite H_update; simpl.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_rest': message_type_eqb ViewChange
  (get_message_type msg') &&
(get_view msg' =? node_view (fst (tr i) n0)) =
true
{|
  get_message_type := PrepareQC;
  get_view := get_view msg0;
  get_sender := get_sender msg0;
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|} = msg' \/
msg0 = msg' \/
In msg' (counting_messages (fst (tr i) n0))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_rest': message_type_eqb ViewChange
  (get_message_type msg') &&
(get_view msg' =? node_view (fst (tr i) n0)) =
true
(get_view msg' =? p) &&
message_type_eqb (get_message_type msg') ViewChange =
true
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0))))
      simpl in H_in'.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': msg0 = msg' \/
In msg' (counting_messages (fst (tr i) n0))
H_rest': message_type_eqb ViewChange
  (get_message_type msg') &&
(get_view msg' =? node_view (fst (tr i) n0)) =
true
{|
  get_message_type := PrepareQC;
  get_view := get_view msg0;
  get_sender := get_sender msg0;
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|} = msg' \/
msg0 = msg' \/
In msg' (counting_messages (fst (tr i) n0))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_rest': message_type_eqb ViewChange
  (get_message_type msg') &&
(get_view msg' =? node_view (fst (tr i) n0)) =
true
(get_view msg' =? p) &&
message_type_eqb (get_message_type msg') ViewChange =
true
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0)))) tauto.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_rest': message_type_eqb ViewChange
  (get_message_type msg') &&
(get_view msg' =? node_view (fst (tr i) n0)) =
true
(get_view msg' =? p) &&
message_type_eqb (get_message_type msg') ViewChange =
true
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0))))
      apply andb_prop in H_rest'.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_rest': message_type_eqb ViewChange
  (get_message_type msg') = true /\
(get_view msg' =? node_view (fst (tr i) n0)) =
true
(get_view msg' =? p) &&
message_type_eqb (get_message_type msg') ViewChange =
true
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0))))
      destruct H_rest' as [H_type' H_view'].tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_type': message_type_eqb ViewChange
  (get_message_type msg') = true
H_view': (get_view msg' =? node_view (fst (tr i) n0)) =
true
(get_view msg' =? p) &&
message_type_eqb (get_message_type msg') ViewChange =
true
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0))))
      apply andb_true_intro.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_type': message_type_eqb ViewChange
  (get_message_type msg') = true
H_view': (get_view msg' =? node_view (fst (tr i) n0)) =
true
(get_view msg' =? p) = true /\
message_type_eqb (get_message_type msg') ViewChange =
true
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0)))) split.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_type': message_type_eqb ViewChange
  (get_message_type msg') = true
H_view': (get_view msg' =? node_view (fst (tr i) n0)) =
true
(get_view msg' =? p) = true
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_type': message_type_eqb ViewChange
  (get_message_type msg') = true
H_view': (get_view msg' =? node_view (fst (tr i) n0)) =
true
message_type_eqb (get_message_type msg') ViewChange =
true
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0))))
      rewrite <- H_view.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_type': message_type_eqb ViewChange
  (get_message_type msg') = true
H_view': (get_view msg' =? node_view (fst (tr i) n0)) =
true
(get_view msg' =? get_view msg) = true
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_type': message_type_eqb ViewChange
  (get_message_type msg') = true
H_view': (get_view msg' =? node_view (fst (tr i) n0)) =
true
message_type_eqb (get_message_type msg') ViewChange =
true
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0))))
      rewrite <- H_in.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_type': message_type_eqb ViewChange
  (get_message_type msg') = true
H_view': (get_view msg' =? node_view (fst (tr i) n0)) =
true
(get_view msg' =?
 get_view
   (make_ViewChangeQC (fst (tr i) n0)
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0)))) = true
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_type': message_type_eqb ViewChange
  (get_message_type msg') = true
H_view': (get_view msg' =? node_view (fst (tr i) n0)) =
true
message_type_eqb (get_message_type msg') ViewChange =
true
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0)))) 
      simpl.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_type': message_type_eqb ViewChange
  (get_message_type msg') = true
H_view': (get_view msg' =? node_view (fst (tr i) n0)) =
true
(get_view msg' =? node_view (fst (tr i) n0)) = true
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_type': message_type_eqb ViewChange
  (get_message_type msg') = true
H_view': (get_view msg' =? node_view (fst (tr i) n0)) =
true
message_type_eqb (get_message_type msg') ViewChange =
true
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0)))) assumption.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_type': message_type_eqb ViewChange
  (get_message_type msg') = true
H_view': (get_view msg' =? node_view (fst (tr i) n0)) =
true
message_type_eqb (get_message_type msg') ViewChange =
true
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0))))
      apply message_type_eqb_correct.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_type': message_type_eqb ViewChange
  (get_message_type msg') = true
H_view': (get_view msg' =? node_view (fst (tr i) n0)) =
true
get_message_type msg' = ViewChange
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0)))) symmetry.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_type': message_type_eqb ViewChange
  (get_message_type msg') = true
H_view': (get_view msg' =? node_view (fst (tr i) n0)) =
true
ViewChange = get_message_type msg'
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0))))
      apply message_type_eqb_correct in H_type'.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
msg': message
H_in': In msg'
  (counting_messages
     (process (fst (tr i) n0) msg0))
H_type': ViewChange = get_message_type msg'
H_view': (get_view msg' =? node_view (fst (tr i) n0)) =
true
ViewChange = get_message_type msg'
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0)))) assumption.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0)))) assumption.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block msg =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0))))
      rewrite <- H_in.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block
    (make_ViewChangeQC (fst (tr i) n0)
       (highest_ViewChange_message
          (process (fst (tr i) n0) msg0))) =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0)))) simpl.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
exists n : node,
  get_block
    (highest_ViewChange_message
       (process (fst (tr i) n0) msg0)) =
  get_block
    (highest_message_in_list n ViewChange
       (processed_ViewChange_in_view
          (process (fst (tr i) n0) msg0)
          (node_view (fst (tr i) n0))))
      (* highest_block property *) 
      exists n0.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
get_block
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
get_block
  (highest_message_in_list n0 ViewChange
     (processed_ViewChange_in_view
        (process (fst (tr i) n0) msg0)
        (node_view (fst (tr i) n0)))) unfold highest_message_in_list.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
get_block
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) =
get_block
  (fold_right higher_message
     {|
       get_message_type := ViewChange;
       get_view := 0;
       get_sender := n0;
       get_block := GenesisBlock;
       get_piggyback_block := GenesisBlock
     |}
     (processed_ViewChange_in_view
        (process (fst (tr i) n0) msg0)
        (node_view (fst (tr i) n0))))
      unfold highest_ViewChange_message.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
get_block
  (highest_message_in_list
     (node_id (process (fst (tr i) n0) msg0))
     ViewChange
     (processed_ViewChange_in_view
        (process (fst (tr i) n0) msg0)
        (node_view (process (fst (tr i) n0) msg0)))) =
get_block
  (fold_right higher_message
     {|
       get_message_type := ViewChange;
       get_view := 0;
       get_sender := n0;
       get_block := GenesisBlock;
       get_piggyback_block := GenesisBlock
     |}
     (processed_ViewChange_in_view
        (process (fst (tr i) n0) msg0)
        (node_view (fst (tr i) n0))))
      f_equal.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
highest_message_in_list
  (node_id (process (fst (tr i) n0) msg0)) ViewChange
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (process (fst (tr i) n0) msg0))) =
fold_right higher_message
  {|
    get_message_type := ViewChange;
    get_view := 0;
    get_sender := n0;
    get_block := GenesisBlock;
    get_piggyback_block := GenesisBlock
  |}
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0))) f_equal.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
highest_message_in_list
  (node_id (process (fst (tr i) n0) msg0)) ViewChange
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (process (fst (tr i) n0) msg0))) =
fold_right higher_message
  {|
    get_message_type := ViewChange;
    get_view := 0;
    get_sender := n0;
    get_block := GenesisBlock;
    get_piggyback_block := GenesisBlock
  |}
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0))) unfold GenesisBlock_message.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
highest_message_in_list
  (node_id (process (fst (tr i) n0) msg0)) ViewChange
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (process (fst (tr i) n0) msg0))) =
fold_right higher_message
  {|
    get_message_type := ViewChange;
    get_view := 0;
    get_sender := n0;
    get_block := GenesisBlock;
    get_piggyback_block := GenesisBlock
  |}
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
      simpl.tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
highest_message_in_list 
  (node_id (fst (tr i) n0)) ViewChange
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0))) =
fold_right higher_message
  {|
    get_message_type := ViewChange;
    get_view := 0;
    get_sender := n0;
    get_block := GenesisBlock;
    get_piggyback_block := GenesisBlock
  |}
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
      rewrite (protocol_trace_state_sane H_prot_copy).tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
n0: node
lm0: list message
msg0: message
H_in: make_ViewChangeQC (fst (tr i) n0)
  (highest_ViewChange_message
     (process (fst (tr i) n0) msg0)) = msg
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_in0: In n0 participants
H_update: fst (tr (S i)) n0 =
record_plural
  (increment_view
     (process
        (process (fst (tr i) n0) msg0)
        {|
          get_message_type := PrepareQC;
          get_view := get_view msg0;
          get_sender := get_sender msg0;
          get_block :=
            get_block
              (highest_ViewChange_message
                 (process 
                    (fst (tr i) n0) msg0));
          get_piggyback_block :=
            GenesisBlock
        |}))
  ({|
     get_message_type := PrepareQC;
     get_view := node_view (fst (tr i) n0);
     get_sender := node_id (fst (tr i) n0);
     get_block :=
       get_block
         (highest_ViewChange_message
            (process (fst (tr i) n0) msg0));
     get_piggyback_block := GenesisBlock
   |}
   :: make_ViewChangeQC 
        (fst (tr i) n0)
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
      :: make_PrepareBlocks
           (increment_view (fst (tr i) n0))
           (highest_ViewChange_message
              (process (fst (tr i) n0) msg0)))
H_out: lm0 =
{|
  get_message_type := PrepareQC;
  get_view := node_view (fst (tr i) n0);
  get_sender := node_id (fst (tr i) n0);
  get_block :=
    get_block
      (highest_ViewChange_message
         (process (fst (tr i) n0) msg0));
  get_piggyback_block := GenesisBlock
|}
:: make_ViewChangeQC (fst (tr i) n0)
     (highest_ViewChange_message
        (process (fst (tr i) n0) msg0))
   :: make_PrepareBlocks
        (increment_view (fst (tr i) n0))
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0))
H_rest: received (fst (tr i) n0) msg0 /\
received (fst (tr i) n0)
  {|
    get_message_type := PrepareQC;
    get_view := get_view msg0;
    get_sender := get_sender msg0;
    get_block :=
      get_block
        (highest_ViewChange_message
           (process (fst (tr i) n0) msg0));
    get_piggyback_block := GenesisBlock
  |} /\
honest_node (node_id (fst (tr i) n0)) /\
get_message_type msg0 = ViewChange /\
view_valid (fst (tr i) n0) msg0 /\
view_change_quorum_in_view
  (process (fst (tr i) n0) msg0)
  (node_view (fst (tr i) n0)) /\
is_block_proposer (node_id (fst (tr i) n0))
  (S (node_view (fst (tr i) n0)))
H_deliver: tr (S i) =
broadcast_messages (tr i) 
  (fst (tr i) n0) (fst (tr (S i)) n0) lm0
H_step_copy: get_transition
  process_ViewChange_quorum_new_proposer_type
  (fst (tr i) n0) msg0
  (fst (tr (S i)) n0) lm0
H_quorum: quorum
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
highest_message_in_list n0 ViewChange
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0))) =
fold_right higher_message
  {|
    get_message_type := ViewChange;
    get_view := 0;
    get_sender := n0;
    get_block := GenesisBlock;
    get_piggyback_block := GenesisBlock
  |}
  (processed_ViewChange_in_view
     (process (fst (tr i) n0) msg0)
     (node_view (fst (tr i) n0)))
      easy. 
    * (* In the timeout case *)tr: GTrace
i, p: nat
msg: message
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = p
H_in: In msg (snd (tr (S i)))
H: ~ In msg (snd (tr i))
H_prot_copy: protocol_trace tr
H_timeout: tr (S i) =
(fun n : node =>
 if is_member n participants
 then flip_timeout (fst (tr i) n)
 else fst (tr i) n, snd (tr i))
exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb 
           (get_message_type msg0) ViewChange)
        (snd (tr (S i))))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n ViewChange lm))
      rewrite H_timeout in H_in;
        contradiction.
Qed.

The highest block of any quorum list of ViewChange messages is at least maximum height minus one:

Definition at_least_second_highest :=
  forall tr i h p, protocol_trace tr ->
    is_max_prepare_height_in_view_global tr i h p ->
    forall (lm : list message),
      (* Subset of all ViewChange messages *) 
      (forall msg, In msg lm ->
        In msg (filter (fun msg0 : message =>
        (get_view msg0 =? p) && message_type_eqb (get_message_type msg0) ViewChange) (snd (tr i)))) ->
      (* Quorum of ViewChange messages *)
      quorum lm ->
      forall n, b_height (get_block (highest_message_in_list n ViewChange lm)) >= h - 1.

Establishing a relationship between the maximum prepare height and the height of the timeout trigger message block towards the final statement below:

Lemma timeout_trigger_message_at_least_second_highest_global :
  at_least_second_highest -> 
  forall tr i p msg h_max, protocol_trace tr ->
    timeout_trigger_message_global tr i p msg ->
    is_max_prepare_height_in_view_global tr i h_max p -> 
    b_height (get_block msg) >= h_max - 1.at_least_second_highest ->
forall (tr : GTrace) (i p : nat) (msg : message)
  (h_max : nat),
protocol_trace tr ->
timeout_trigger_message_global tr i p msg ->
is_max_prepare_height_in_view_global tr i h_max p ->
b_height (get_block msg) >= h_max - 1 
Proof.at_least_second_highest ->
forall (tr : GTrace) (i p : nat) (msg : message)
  (h_max : nat),
protocol_trace tr ->
timeout_trigger_message_global tr i p msg ->
is_max_prepare_height_in_view_global tr i h_max p ->
b_height (get_block msg) >= h_max - 1     
  intros H_useful tr i p msg h_max H_prot H_timeout H_highest.H_useful: at_least_second_highest
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_timeout: timeout_trigger_message_global tr i p msg
H_highest: is_max_prepare_height_in_view_global tr i
  h_max p
b_height (get_block msg) >= h_max - 1 
  assert (H_useful2 := timeout_trigger_message_global_means_exists_ViewChange_quorum).H_useful: at_least_second_highest
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_timeout: timeout_trigger_message_global tr i p msg
H_highest: is_max_prepare_height_in_view_global tr i
  h_max p
H_useful2: forall (tr : GTrace) (i p : nat)
  (msg : message),
protocol_trace tr ->
timeout_trigger_message_global tr i p msg ->
exists lm : list message,
  (forall msg0 : message,
   In msg0 lm ->
   In msg0
     (filter
        (fun msg1 : message =>
         (get_view msg1 =? p) &&
         message_type_eqb
           (get_message_type msg1)
           ViewChange) 
        (snd (tr i)))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n
          ViewChange lm))
b_height (get_block msg) >= h_max - 1 
  spec H_useful2 tr i p msg H_prot H_timeout.H_useful: at_least_second_highest
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_timeout: timeout_trigger_message_global tr i p msg
H_highest: is_max_prepare_height_in_view_global tr i
  h_max p
H_useful2: exists lm : list message,
  (forall msg : message,
   In msg lm ->
   In msg
     (filter
        (fun msg0 : message =>
         (get_view msg0 =? p) &&
         message_type_eqb
           (get_message_type msg0)
           ViewChange) 
        (snd (tr i)))) /\
  quorum lm /\
  (exists n : node,
     get_block msg =
     get_block
       (highest_message_in_list n
          ViewChange lm))
b_height (get_block msg) >= h_max - 1
  destruct H_useful2 as [lm [H_subset [H_quorum [n H_highest_msg]]]].H_useful: at_least_second_highest
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_timeout: timeout_trigger_message_global tr i p msg
H_highest: is_max_prepare_height_in_view_global tr i
  h_max p
lm: list message
H_subset: forall msg : message,
In msg lm ->
In msg
  (filter
     (fun msg0 : message =>
      (get_view msg0 =? p) &&
      message_type_eqb
        (get_message_type msg0) ViewChange)
     (snd (tr i)))
H_quorum: quorum lm
n: node
H_highest_msg: get_block msg =
get_block
  (highest_message_in_list n
     ViewChange lm)
b_height (get_block msg) >= h_max - 1
  spec H_useful tr i h_max p H_prot H_highest.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_timeout: timeout_trigger_message_global tr i p msg
H_highest: is_max_prepare_height_in_view_global tr i
  h_max p
lm: list message
H_subset: forall msg : message,
In msg lm ->
In msg
  (filter
     (fun msg0 : message =>
      (get_view msg0 =? p) &&
      message_type_eqb
        (get_message_type msg0) ViewChange)
     (snd (tr i)))
H_quorum: quorum lm
n: node
H_highest_msg: get_block msg =
get_block
  (highest_message_in_list n
     ViewChange lm)
H_useful: forall lm : list message,
(forall msg : message,
 In msg lm ->
 In msg
   (filter
      (fun msg0 : message =>
       (get_view msg0 =? p) &&
       message_type_eqb
         (get_message_type msg0) ViewChange)
      (snd (tr i)))) ->
quorum lm ->
forall n : node,
b_height
  (get_block
     (highest_message_in_list n ViewChange
        lm)) >= h_max - 1
b_height (get_block msg) >= h_max - 1
  spec H_useful lm H_subset H_quorum n.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_timeout: timeout_trigger_message_global tr i p msg
H_highest: is_max_prepare_height_in_view_global tr i
  h_max p
lm: list message
H_subset: forall msg : message,
In msg lm ->
In msg
  (filter
     (fun msg0 : message =>
      (get_view msg0 =? p) &&
      message_type_eqb
        (get_message_type msg0) ViewChange)
     (snd (tr i)))
H_quorum: quorum lm
n: node
H_highest_msg: get_block msg =
get_block
  (highest_message_in_list n
     ViewChange lm)
H_useful: b_height
  (get_block
     (highest_message_in_list n ViewChange
        lm)) >= h_max - 1
b_height (get_block msg) >= h_max - 1
  rewrite H_highest_msg.tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_timeout: timeout_trigger_message_global tr i p msg
H_highest: is_max_prepare_height_in_view_global tr i
  h_max p
lm: list message
H_subset: forall msg : message,
In msg lm ->
In msg
  (filter
     (fun msg0 : message =>
      (get_view msg0 =? p) &&
      message_type_eqb
        (get_message_type msg0) ViewChange)
     (snd (tr i)))
H_quorum: quorum lm
n: node
H_highest_msg: get_block msg =
get_block
  (highest_message_in_list n
     ViewChange lm)
H_useful: b_height
  (get_block
     (highest_message_in_list n ViewChange
        lm)) >= h_max - 1
b_height
  (get_block (highest_message_in_list n ViewChange lm)) >=
h_max - 1
  assumption.
Qed.

We are now able to show that the block contained in the trigger message for a view is either the highest block in the view, or the second highest block in the view:

Lemma timeout_trigger_message_highest_or_second_highest_global :
  at_least_second_highest -> 
  forall tr i p msg h_max, protocol_trace tr ->
    timeout_trigger_message_global tr i p msg ->
    is_max_prepare_height_in_view_global tr i h_max p ->
    b_height (get_block msg) = h_max \/
    b_height (get_block msg) = h_max - 1.at_least_second_highest ->
forall (tr : GTrace) (i p : nat) (msg : message)
  (h_max : nat),
protocol_trace tr ->
timeout_trigger_message_global tr i p msg ->
is_max_prepare_height_in_view_global tr i h_max p ->
b_height (get_block msg) = h_max \/
b_height (get_block msg) = h_max - 1 
Proof.at_least_second_highest ->
forall (tr : GTrace) (i p : nat) (msg : message)
  (h_max : nat),
protocol_trace tr ->
timeout_trigger_message_global tr i p msg ->
is_max_prepare_height_in_view_global tr i h_max p ->
b_height (get_block msg) = h_max \/
b_height (get_block msg) = h_max - 1
  intros H_ass tr i p msg h_max H_prot H_timeout H_max.H_ass: at_least_second_highest
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_timeout: timeout_trigger_message_global tr i p msg
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
b_height (get_block msg) = h_max \/
b_height (get_block msg) = h_max - 1
  assert (H_useful := is_max_prepare_height_in_view_disj_global).H_ass: at_least_second_highest
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_timeout: timeout_trigger_message_global tr i p msg
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
H_useful: forall (tr : GTrace) (i h p : nat),
protocol_trace tr ->
is_max_prepare_height_in_view_global tr i h
  p ->
forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b = h \/ b_height b < h
b_height (get_block msg) = h_max \/
b_height (get_block msg) = h_max - 1 
  spec H_useful tr i h_max p H_prot H_max.H_ass: at_least_second_highest
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_timeout: timeout_trigger_message_global tr i p msg
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
H_useful: forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b = h_max \/ b_height b < h_max
b_height (get_block msg) = h_max \/
b_height (get_block msg) = h_max - 1
  spec H_useful (get_block msg).H_ass: at_least_second_highest
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_timeout: timeout_trigger_message_global tr i p msg
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
H_useful: prepare_stage_in_view_global tr i
  (get_block msg) p ->
b_height (get_block msg) = h_max \/
b_height (get_block msg) < h_max
b_height (get_block msg) = h_max \/
b_height (get_block msg) = h_max - 1
  spec H_useful.H_ass: at_least_second_highest
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_timeout: timeout_trigger_message_global tr i p msg
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
H_useful: prepare_stage_in_view_global tr i
  (get_block msg) p ->
b_height (get_block msg) = h_max \/
b_height (get_block msg) < h_max
prepare_stage_in_view_global tr i (get_block msg) p
H_ass: at_least_second_highest
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_timeout: timeout_trigger_message_global tr i p msg
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
H_useful: b_height (get_block msg) = h_max \/
b_height (get_block msg) < h_max
b_height (get_block msg) = h_max \/
b_height (get_block msg) = h_max - 1
  apply trigger_message_block_prepare_stage_global;
    try assumption; right; tauto.H_ass: at_least_second_highest
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_timeout: timeout_trigger_message_global tr i p msg
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
H_useful: b_height (get_block msg) = h_max \/
b_height (get_block msg) < h_max
b_height (get_block msg) = h_max \/
b_height (get_block msg) = h_max - 1 
  destruct H_useful as [H_highest | H_second].H_ass: at_least_second_highest
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_timeout: timeout_trigger_message_global tr i p msg
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
H_highest: b_height (get_block msg) = h_max
b_height (get_block msg) = h_max \/
b_height (get_block msg) = h_max - 1
H_ass: at_least_second_highest
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_timeout: timeout_trigger_message_global tr i p msg
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
H_second: b_height (get_block msg) < h_max
b_height (get_block msg) = h_max \/
b_height (get_block msg) = h_max - 1
  -H_ass: at_least_second_highest
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_timeout: timeout_trigger_message_global tr i p msg
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
H_highest: b_height (get_block msg) = h_max
b_height (get_block msg) = h_max \/
b_height (get_block msg) = h_max - 1 tauto.
  - (* Now we need to show that it cannot be lower than h_max - 1 *)H_ass: at_least_second_highest
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_timeout: timeout_trigger_message_global tr i p msg
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
H_second: b_height (get_block msg) < h_max
b_height (get_block msg) = h_max \/
b_height (get_block msg) = h_max - 1
    (* There is another pigeonhole principle argument embedded in here *)
    assert (H_useful := timeout_trigger_message_at_least_second_highest_global).H_ass: at_least_second_highest
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_timeout: timeout_trigger_message_global tr i p msg
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
H_second: b_height (get_block msg) < h_max
H_useful: at_least_second_highest ->
forall (tr : GTrace) (i p : nat)
  (msg : message) (h_max : nat),
protocol_trace tr ->
timeout_trigger_message_global tr i p msg ->
is_max_prepare_height_in_view_global tr i
  h_max p ->
b_height (get_block msg) >= h_max - 1
b_height (get_block msg) = h_max \/
b_height (get_block msg) = h_max - 1
    spec H_useful H_ass tr i p msg h_max H_prot.H_ass: at_least_second_highest
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_timeout: timeout_trigger_message_global tr i p msg
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
H_second: b_height (get_block msg) < h_max
H_useful: timeout_trigger_message_global tr i p msg ->
is_max_prepare_height_in_view_global tr i
  h_max p ->
b_height (get_block msg) >= h_max - 1
b_height (get_block msg) = h_max \/
b_height (get_block msg) = h_max - 1
    spec H_useful H_timeout H_max.H_ass: at_least_second_highest
tr: GTrace
i, p: nat
msg: message
h_max: nat
H_prot: protocol_trace tr
H_timeout: timeout_trigger_message_global tr i p msg
H_max: is_max_prepare_height_in_view_global tr i
  h_max p
H_second: b_height (get_block msg) < h_max
H_useful: b_height (get_block msg) >= h_max - 1
b_height (get_block msg) = h_max \/
b_height (get_block msg) = h_max - 1
    lia.
Qed.

Global trigger message blocks increase with view

Having established global trigger message blocks as both lower bounds and higher bounds, the final critical fact we need to show is that the height of trigger message blocks increases as view increases.

Lemma trigger_message_past_step_exists_global :
  forall tr i v msg, protocol_trace tr ->
    trigger_message_global tr i (S v) msg ->
    exists msg', trigger_message_global tr i v msg'.forall (tr : GTrace) (i v : nat) (msg : message),
protocol_trace tr ->
trigger_message_global tr i (S v) msg ->
exists msg' : message,
  trigger_message_global tr i v msg'
Proof.forall (tr : GTrace) (i v : nat) (msg : message),
protocol_trace tr ->
trigger_message_global tr i (S v) msg ->
exists msg' : message,
  trigger_message_global tr i v msg'   
  intros tr i v msg H_prot H_trigger.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_trigger: trigger_message_global tr i (S v) msg
exists msg' : message,
  trigger_message_global tr i v msg'
  assert (H_useful := past_view_exists_trigger_message_global).tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_trigger: trigger_message_global tr i (S v) msg
H_useful: forall tr : GTrace,
protocol_trace tr ->
forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg' 
  spec H_useful tr H_prot.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_trigger: trigger_message_global tr i (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
  red in H_trigger.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_trigger: normal_trigger_message_global tr i 
  (S v) msg \/
timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
  destruct H_trigger as [H_left | H_right].tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: normal_trigger_message_global tr i (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
  red in H_left.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
  spec H_useful (get_sender msg) i.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: In (get_sender msg) participants ->
forall v_past : nat,
v_past <
node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
  spec H_useful.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: In (get_sender msg) participants ->
forall v_past : nat,
v_past <
node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v_past msg
In (get_sender msg) participants
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: forall v_past : nat,
v_past <
node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg' now apply participation_rights_global with tr i.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: forall v_past : nat,
v_past <
node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
  spec H_useful v.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg' spec H_useful.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
  assert (H_bound := (out_message_view_bound)).tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: forall (tr : GTrace) (n : node) (i : nat),
protocol_trace tr ->
In n participants ->
forall msg : message,
In msg (out_messages (fst (tr i) n)) ->
get_view msg <= node_view (fst (tr i) n)
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
  spec H_bound tr (get_sender msg) i H_prot.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: In (get_sender msg) participants ->
forall msg0 : message,
In msg0
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg0 <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
  spec H_bound.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: In (get_sender msg) participants ->
forall msg0 : message,
In msg0
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg0 <=
node_view (fst (tr i) (get_sender msg))
In (get_sender msg) participants
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: forall msg0 : message,
In msg0
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg0 <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
  now apply participation_rights_global with tr i.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: forall msg0 : message,
In msg0
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg0 <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
  spec H_bound msg.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: In msg
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
  spec H_bound.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: In msg
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg <=
node_view (fst (tr i) (get_sender msg))
In msg (out_messages (fst (tr i) (get_sender msg)))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: get_view msg <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
  apply global_local_out_if; try assumption.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: In msg
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg <=
node_view (fst (tr i) (get_sender msg))
In (get_sender msg) participants
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: In msg
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg <=
node_view (fst (tr i) (get_sender msg))
In msg
  (filter
     (fun msg0 : message =>
      node_eqb (get_sender msg0) (get_sender msg))
     (snd (tr i)))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: get_view msg <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
  now apply participation_rights_global with tr i.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: In msg
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg <=
node_view (fst (tr i) (get_sender msg))
In msg
  (filter
     (fun msg0 : message =>
      node_eqb (get_sender msg0) (get_sender msg))
     (snd (tr i)))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: get_view msg <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
  apply filter_In.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: In msg
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg <=
node_view (fst (tr i) (get_sender msg))
In msg (snd (tr i)) /\
node_eqb (get_sender msg) (get_sender msg) = true
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: get_view msg <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg' split.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: In msg
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg <=
node_view (fst (tr i) (get_sender msg))
In msg (snd (tr i))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: In msg
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg <=
node_view (fst (tr i) (get_sender msg))
node_eqb (get_sender msg) (get_sender msg) = true
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: get_view msg <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg' tauto.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: In msg
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg <=
node_view (fst (tr i) (get_sender msg))
node_eqb (get_sender msg) (get_sender msg) = true
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: get_view msg <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
  apply node_eqb_correct; reflexivity.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: get_view msg <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
  destruct H_left as [H_type [H_view H_rest]].tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = PrepareQC
H_view: get_view msg = S v
H_rest: b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: get_view msg <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
  lia.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_left: get_message_type msg = PrepareQC /\
get_view msg = S v /\
b_last (get_block msg) = true /\
In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg' assumption.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: timeout_trigger_message_global tr i 
  (S v) msg
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
  red in H_right.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
  spec H_useful (get_sender msg) i.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: In (get_sender msg) participants ->
forall v_past : nat,
v_past <
node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
  spec H_useful.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: In (get_sender msg) participants ->
forall v_past : nat,
v_past <
node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v_past msg
In (get_sender msg) participants
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: forall v_past : nat,
v_past <
node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg' now apply participation_rights_global with tr i.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: forall v_past : nat,
v_past <
node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v_past msg
exists msg' : message,
  trigger_message_global tr i v msg'
  spec H_useful v.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg' spec H_useful.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
  assert (H_bound := (out_message_view_bound)).tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: forall (tr : GTrace) (n : node) (i : nat),
protocol_trace tr ->
In n participants ->
forall msg : message,
In msg (out_messages (fst (tr i) n)) ->
get_view msg <= node_view (fst (tr i) n)
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
  spec H_bound tr (get_sender msg) i H_prot.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: In (get_sender msg) participants ->
forall msg0 : message,
In msg0
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg0 <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
  spec H_bound.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: In (get_sender msg) participants ->
forall msg0 : message,
In msg0
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg0 <=
node_view (fst (tr i) (get_sender msg))
In (get_sender msg) participants
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: forall msg0 : message,
In msg0
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg0 <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
  now apply participation_rights_global with tr i.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: forall msg0 : message,
In msg0
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg0 <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
  spec H_bound msg.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: In msg
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
  spec H_bound.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: In msg
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg <=
node_view (fst (tr i) (get_sender msg))
In msg (out_messages (fst (tr i) (get_sender msg)))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: get_view msg <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
  apply global_local_out_if; try assumption.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: In msg
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg <=
node_view (fst (tr i) (get_sender msg))
In (get_sender msg) participants
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: In msg
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg <=
node_view (fst (tr i) (get_sender msg))
In msg
  (filter
     (fun msg0 : message =>
      node_eqb (get_sender msg0) (get_sender msg))
     (snd (tr i)))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: get_view msg <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
  now apply participation_rights_global with tr i.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: In msg
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg <=
node_view (fst (tr i) (get_sender msg))
In msg
  (filter
     (fun msg0 : message =>
      node_eqb (get_sender msg0) (get_sender msg))
     (snd (tr i)))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: get_view msg <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
  apply filter_In.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: In msg
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg <=
node_view (fst (tr i) (get_sender msg))
In msg (snd (tr i)) /\
node_eqb (get_sender msg) (get_sender msg) = true
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: get_view msg <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg' split.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: In msg
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg <=
node_view (fst (tr i) (get_sender msg))
In msg (snd (tr i))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: In msg
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg <=
node_view (fst (tr i) (get_sender msg))
node_eqb (get_sender msg) (get_sender msg) = true
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: get_view msg <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg' tauto.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: In msg
  (out_messages
     (fst (tr i) (get_sender msg))) ->
get_view msg <=
node_view (fst (tr i) (get_sender msg))
node_eqb (get_sender msg) (get_sender msg) = true
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: get_view msg <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
  apply node_eqb_correct; reflexivity.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: get_view msg <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
  destruct H_right as [H_type [H_view H_rest]].tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_type: get_message_type msg = ViewChangeQC
H_view: get_view msg = S v
H_rest: In msg (snd (tr i))
H_useful: v < node_view (fst (tr i) (get_sender msg)) ->
exists msg : message,
  trigger_message_global tr i v msg
H_bound: get_view msg <=
node_view (fst (tr i) (get_sender msg))
v < node_view (fst (tr i) (get_sender msg))
tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg'
  lia.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_right: get_message_type msg = ViewChangeQC /\
get_view msg = S v /\ In msg (snd (tr i))
H_useful: exists msg : message,
  trigger_message_global tr i v msg
exists msg' : message,
  trigger_message_global tr i v msg' assumption.
Qed.

Lemma trigger_message_past_exists_global :
  forall tr i v msg, protocol_trace tr ->
    trigger_message_global tr i v msg ->
    forall v', v' <= v ->
      exists msg', trigger_message_global tr i v' msg'.forall (tr : GTrace) (i v : nat) (msg : message),
protocol_trace tr ->
trigger_message_global tr i v msg ->
forall v' : nat,
v' <= v ->
exists msg' : message,
  trigger_message_global tr i v' msg' 
Proof.forall (tr : GTrace) (i v : nat) (msg : message),
protocol_trace tr ->
trigger_message_global tr i v msg ->
forall v' : nat,
v' <= v ->
exists msg' : message,
  trigger_message_global tr i v' msg'
  intros tr i v msg H_prot H_trigger v_past H_past.tr: GTrace
i, v: nat
msg: message
H_prot: protocol_trace tr
H_trigger: trigger_message_global tr i v msg
v_past: nat
H_past: v_past <= v
exists msg' : message,
  trigger_message_global tr i v_past msg'
  generalize dependent msg.tr: GTrace
i, v: nat
H_prot: protocol_trace tr
v_past: nat
H_past: v_past <= v
forall msg : message,
trigger_message_global tr i v msg ->
exists msg' : message,
  trigger_message_global tr i v_past msg' 
  induction v as [|v IHv]; intros.tr: GTrace
i: nat
H_prot: protocol_trace tr
v_past: nat
H_past: v_past <= 0
msg: message
H_trigger: trigger_message_global tr i 0 msg
exists msg' : message,
  trigger_message_global tr i v_past msg'
tr: GTrace
i, v: nat
H_prot: protocol_trace tr
v_past: nat
H_past: v_past <= S v
IHv: v_past <= v ->
forall msg : message,
trigger_message_global tr i v msg ->
exists msg' : message,
  trigger_message_global tr i v_past msg'
msg: message
H_trigger: trigger_message_global tr i (S v) msg
exists msg' : message,
  trigger_message_global tr i v_past msg'
  -tr: GTrace
i: nat
H_prot: protocol_trace tr
v_past: nat
H_past: v_past <= 0
msg: message
H_trigger: trigger_message_global tr i 0 msg
exists msg' : message,
  trigger_message_global tr i v_past msg' inversion H_past; subst.tr: GTrace
i: nat
H_prot: protocol_trace tr
H_past: 0 <= 0
msg: message
H_trigger: trigger_message_global tr i 0 msg
exists msg' : message,
  trigger_message_global tr i 0 msg'
    exists msg.tr: GTrace
i: nat
H_prot: protocol_trace tr
H_past: 0 <= 0
msg: message
H_trigger: trigger_message_global tr i 0 msg
trigger_message_global tr i 0 msg     
    assumption.
  -tr: GTrace
i, v: nat
H_prot: protocol_trace tr
v_past: nat
H_past: v_past <= S v
IHv: v_past <= v ->
forall msg : message,
trigger_message_global tr i v msg ->
exists msg' : message,
  trigger_message_global tr i v_past msg'
msg: message
H_trigger: trigger_message_global tr i (S v) msg
exists msg' : message,
  trigger_message_global tr i v_past msg' assert (v_past <= v \/ v_past = S v) by lia.tr: GTrace
i, v: nat
H_prot: protocol_trace tr
v_past: nat
H_past: v_past <= S v
IHv: v_past <= v ->
forall msg : message,
trigger_message_global tr i v msg ->
exists msg' : message,
  trigger_message_global tr i v_past msg'
msg: message
H_trigger: trigger_message_global tr i (S v) msg
H: v_past <= v \/ v_past = S v
exists msg' : message,
  trigger_message_global tr i v_past msg' 
    destruct H.tr: GTrace
i, v: nat
H_prot: protocol_trace tr
v_past: nat
H_past: v_past <= S v
IHv: v_past <= v ->
forall msg : message,
trigger_message_global tr i v msg ->
exists msg' : message,
  trigger_message_global tr i v_past msg'
msg: message
H_trigger: trigger_message_global tr i (S v) msg
H: v_past <= v
exists msg' : message,
  trigger_message_global tr i v_past msg'
tr: GTrace
i, v: nat
H_prot: protocol_trace tr
v_past: nat
H_past: v_past <= S v
IHv: v_past <= v ->
forall msg : message,
trigger_message_global tr i v msg ->
exists msg' : message,
  trigger_message_global tr i v_past msg'
msg: message
H_trigger: trigger_message_global tr i (S v) msg
H: v_past = S v
exists msg' : message,
  trigger_message_global tr i v_past msg' spec IHv H.tr: GTrace
i, v: nat
H_prot: protocol_trace tr
v_past: nat
H_past: v_past <= S v
msg: message
H_trigger: trigger_message_global tr i (S v) msg
H: v_past <= v
IHv: forall msg : message,
trigger_message_global tr i v msg ->
exists msg' : message,
  trigger_message_global tr i v_past msg'
exists msg' : message,
  trigger_message_global tr i v_past msg'
tr: GTrace
i, v: nat
H_prot: protocol_trace tr
v_past: nat
H_past: v_past <= S v
IHv: v_past <= v ->
forall msg : message,
trigger_message_global tr i v msg ->
exists msg' : message,
  trigger_message_global tr i v_past msg'
msg: message
H_trigger: trigger_message_global tr i (S v) msg
H: v_past = S v
exists msg' : message,
  trigger_message_global tr i v_past msg'
    assert (H_useful := trigger_message_past_step_exists_global H_prot H_trigger).tr: GTrace
i, v: nat
H_prot: protocol_trace tr
v_past: nat
H_past: v_past <= S v
msg: message
H_trigger: trigger_message_global tr i (S v) msg
H: v_past <= v
IHv: forall msg : message,
trigger_message_global tr i v msg ->
exists msg' : message,
  trigger_message_global tr i v_past msg'
H_useful: exists msg' : message,
  trigger_message_global tr i v msg'
exists msg' : message,
  trigger_message_global tr i v_past msg'
tr: GTrace
i, v: nat
H_prot: protocol_trace tr
v_past: nat
H_past: v_past <= S v
IHv: v_past <= v ->
forall msg : message,
trigger_message_global tr i v msg ->
exists msg' : message,
  trigger_message_global tr i v_past msg'
msg: message
H_trigger: trigger_message_global tr i (S v) msg
H: v_past = S v
exists msg' : message,
  trigger_message_global tr i v_past msg'
    destruct H_useful as [msg' H_trigger'].tr: GTrace
i, v: nat
H_prot: protocol_trace tr
v_past: nat
H_past: v_past <= S v
msg: message
H_trigger: trigger_message_global tr i (S v) msg
H: v_past <= v
IHv: forall msg : message,
trigger_message_global tr i v msg ->
exists msg' : message,
  trigger_message_global tr i v_past msg'
msg': message
H_trigger': trigger_message_global tr i v msg'
exists msg' : message,
  trigger_message_global tr i v_past msg'
tr: GTrace
i, v: nat
H_prot: protocol_trace tr
v_past: nat
H_past: v_past <= S v
IHv: v_past <= v ->
forall msg : message,
trigger_message_global tr i v msg ->
exists msg' : message,
  trigger_message_global tr i v_past msg'
msg: message
H_trigger: trigger_message_global tr i (S v) msg
H: v_past = S v
exists msg' : message,
  trigger_message_global tr i v_past msg'
    spec IHv msg' H_trigger'.tr: GTrace
i, v: nat
H_prot: protocol_trace tr
v_past: nat
H_past: v_past <= S v
msg: message
H_trigger: trigger_message_global tr i (S v) msg
H: v_past <= v
msg': message
H_trigger': trigger_message_global tr i v msg'
IHv: exists msg' : message,
  trigger_message_global tr i v_past msg'
exists msg' : message,
  trigger_message_global tr i v_past msg'
tr: GTrace
i, v: nat
H_prot: protocol_trace tr
v_past: nat
H_past: v_past <= S v
IHv: v_past <= v ->
forall msg : message,
trigger_message_global tr i v msg ->
exists msg' : message,
  trigger_message_global tr i v_past msg'
msg: message
H_trigger: trigger_message_global tr i (S v) msg
H: v_past = S v
exists msg' : message,
  trigger_message_global tr i v_past msg'
    assumption.tr: GTrace
i, v: nat
H_prot: protocol_trace tr
v_past: nat
H_past: v_past <= S v
IHv: v_past <= v ->
forall msg : message,
trigger_message_global tr i v msg ->
exists msg' : message,
  trigger_message_global tr i v_past msg'
msg: message
H_trigger: trigger_message_global tr i (S v) msg
H: v_past = S v
exists msg' : message,
  trigger_message_global tr i v_past msg'
    clear IHv.tr: GTrace
i, v: nat
H_prot: protocol_trace tr
v_past: nat
H_past: v_past <= S v
msg: message
H_trigger: trigger_message_global tr i (S v) msg
H: v_past = S v
exists msg' : message,
  trigger_message_global tr i v_past msg' subst.tr: GTrace
i, v: nat
H_prot: protocol_trace tr
H_past: S v <= S v
msg: message
H_trigger: trigger_message_global tr i (S v) msg
exists msg' : message,
  trigger_message_global tr i (S v) msg'
    now exists msg. 
Qed.

The proof pattern for this lemma is typical of many induction-based proof: we first show the property for one step, then we show it by induction for an arbitrary number of steps.

Lemma trigger_message_view_morphism_step_global :
  trigger_message_next_view_PrepareBlock_same_block_global ->
  forall tr j v1 msg1 msg2, protocol_trace tr ->
    trigger_message_global tr j v1 msg1 ->
    trigger_message_global tr j (S v1) msg2 ->
    b_height (get_block msg1) <= b_height (get_block msg2).trigger_message_next_view_PrepareBlock_same_block_global ->
forall (tr : GTrace) (j v1 : nat)
  (msg1 msg2 : message),
protocol_trace tr ->
trigger_message_global tr j v1 msg1 ->
trigger_message_global tr j (S v1) msg2 ->
b_height (get_block msg1) <= b_height (get_block msg2) 
Proof.trigger_message_next_view_PrepareBlock_same_block_global ->
forall (tr : GTrace) (j v1 : nat)
  (msg1 msg2 : message),
protocol_trace tr ->
trigger_message_global tr j v1 msg1 ->
trigger_message_global tr j (S v1) msg2 ->
b_height (get_block msg1) <= b_height (get_block msg2)
  intros H_useful1 tr j v1 msg1 msg2 H_prot H_trigger1 H_trigger2.H_useful1: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1: nat
msg1, msg2: message
H_prot: protocol_trace tr
H_trigger1: trigger_message_global tr j v1 msg1
H_trigger2: trigger_message_global tr j (S v1) msg2
b_height (get_block msg1) <= b_height (get_block msg2)
  spec H_useful1 tr H_prot j msg1 v1.tr: GTrace
j, v1: nat
msg1, msg2: message
H_prot: protocol_trace tr
H_trigger1: trigger_message_global tr j v1 msg1
H_trigger2: trigger_message_global tr j (S v1) msg2
H_useful1: trigger_message_global tr j v1 msg1 ->
forall pb_msg : message,
get_message_type pb_msg = PrepareBlock ->
get_view pb_msg = S v1 ->
In pb_msg (snd (tr j)) ->
get_piggyback_block pb_msg =
get_block msg1
b_height (get_block msg1) <= b_height (get_block msg2)
  apply trigger_message_block_prepare_stage_global in H_trigger2; try assumption.tr: GTrace
j, v1: nat
msg1, msg2: message
H_prot: protocol_trace tr
H_trigger1: trigger_message_global tr j v1 msg1
H_trigger2: prepare_stage_in_view_global tr j
  (get_block msg2) (S v1)
H_useful1: trigger_message_global tr j v1 msg1 ->
forall pb_msg : message,
get_message_type pb_msg = PrepareBlock ->
get_view pb_msg = S v1 ->
In pb_msg (snd (tr j)) ->
get_piggyback_block pb_msg =
get_block msg1
b_height (get_block msg1) <= b_height (get_block msg2) 
  apply prepare_stage_in_view_means_PrepareBlock_sent_global in H_trigger2; try assumption.tr: GTrace
j, v1: nat
msg1, msg2: message
H_prot: protocol_trace tr
H_trigger1: trigger_message_global tr j v1 msg1
H_trigger2: exists msg : message,
  get_message_type msg = PrepareBlock /\
  S v1 = get_view msg /\
  get_block msg2 = get_block msg /\
  In msg (snd (tr j))
H_useful1: trigger_message_global tr j v1 msg1 ->
forall pb_msg : message,
get_message_type pb_msg = PrepareBlock ->
get_view pb_msg = S v1 ->
In pb_msg (snd (tr j)) ->
get_piggyback_block pb_msg =
get_block msg1
b_height (get_block msg1) <= b_height (get_block msg2) 
  destruct H_trigger2 as [pb_msg2 [H_type2 [H_view2 [H_block2 H_sent2]]]].tr: GTrace
j, v1: nat
msg1, msg2: message
H_prot: protocol_trace tr
H_trigger1: trigger_message_global tr j v1 msg1
pb_msg2: message
H_type2: get_message_type pb_msg2 = PrepareBlock
H_view2: S v1 = get_view pb_msg2
H_block2: get_block msg2 = get_block pb_msg2
H_sent2: In pb_msg2 (snd (tr j))
H_useful1: trigger_message_global tr j v1 msg1 ->
forall pb_msg : message,
get_message_type pb_msg = PrepareBlock ->
get_view pb_msg = S v1 ->
In pb_msg (snd (tr j)) ->
get_piggyback_block pb_msg =
get_block msg1
b_height (get_block msg1) <= b_height (get_block msg2)
  symmetry in H_view2.tr: GTrace
j, v1: nat
msg1, msg2: message
H_prot: protocol_trace tr
H_trigger1: trigger_message_global tr j v1 msg1
pb_msg2: message
H_type2: get_message_type pb_msg2 = PrepareBlock
H_view2: get_view pb_msg2 = S v1
H_block2: get_block msg2 = get_block pb_msg2
H_sent2: In pb_msg2 (snd (tr j))
H_useful1: trigger_message_global tr j v1 msg1 ->
forall pb_msg : message,
get_message_type pb_msg = PrepareBlock ->
get_view pb_msg = S v1 ->
In pb_msg (snd (tr j)) ->
get_piggyback_block pb_msg =
get_block msg1
b_height (get_block msg1) <= b_height (get_block msg2)
  spec H_useful1 H_trigger1 pb_msg2 H_type2 H_view2 H_sent2.tr: GTrace
j, v1: nat
msg1, msg2: message
H_prot: protocol_trace tr
H_trigger1: trigger_message_global tr j v1 msg1
pb_msg2: message
H_type2: get_message_type pb_msg2 = PrepareBlock
H_view2: get_view pb_msg2 = S v1
H_block2: get_block msg2 = get_block pb_msg2
H_sent2: In pb_msg2 (snd (tr j))
H_useful1: get_piggyback_block pb_msg2 =
get_block msg1
b_height (get_block msg1) <= b_height (get_block msg2)
  rewrite <- H_useful1.tr: GTrace
j, v1: nat
msg1, msg2: message
H_prot: protocol_trace tr
H_trigger1: trigger_message_global tr j v1 msg1
pb_msg2: message
H_type2: get_message_type pb_msg2 = PrepareBlock
H_view2: get_view pb_msg2 = S v1
H_block2: get_block msg2 = get_block pb_msg2
H_sent2: In pb_msg2 (snd (tr j))
H_useful1: get_piggyback_block pb_msg2 =
get_block msg1
b_height (get_piggyback_block pb_msg2) <=
b_height (get_block msg2)
  apply Nat.lt_le_incl.tr: GTrace
j, v1: nat
msg1, msg2: message
H_prot: protocol_trace tr
H_trigger1: trigger_message_global tr j v1 msg1
pb_msg2: message
H_type2: get_message_type pb_msg2 = PrepareBlock
H_view2: get_view pb_msg2 = S v1
H_block2: get_block msg2 = get_block pb_msg2
H_sent2: In pb_msg2 (snd (tr j))
H_useful1: get_piggyback_block pb_msg2 =
get_block msg1
b_height (get_piggyback_block pb_msg2) <
b_height (get_block msg2)
  rewrite H_block2.tr: GTrace
j, v1: nat
msg1, msg2: message
H_prot: protocol_trace tr
H_trigger1: trigger_message_global tr j v1 msg1
pb_msg2: message
H_type2: get_message_type pb_msg2 = PrepareBlock
H_view2: get_view pb_msg2 = S v1
H_block2: get_block msg2 = get_block pb_msg2
H_sent2: In pb_msg2 (snd (tr j))
H_useful1: get_piggyback_block pb_msg2 =
get_block msg1
b_height (get_piggyback_block pb_msg2) <
b_height (get_block pb_msg2)
  now apply PrepareBlock_block_height_geq with tr j. 
Qed.   

Lemma trigger_message_view_morphism_global :
  trigger_message_next_view_PrepareBlock_same_block_global ->
  forall tr j v1 v2 msg1 msg2, protocol_trace tr ->
    v1 < v2 ->
    trigger_message_global tr j v1 msg1 ->
    trigger_message_global tr j v2 msg2 ->
    b_height (get_block msg1) <= b_height (get_block msg2).trigger_message_next_view_PrepareBlock_same_block_global ->
forall (tr : GTrace) (j v1 v2 : nat)
  (msg1 msg2 : message),
protocol_trace tr ->
v1 < v2 ->
trigger_message_global tr j v1 msg1 ->
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <= b_height (get_block msg2)
Proof.trigger_message_next_view_PrepareBlock_same_block_global ->
forall (tr : GTrace) (j v1 v2 : nat)
  (msg1 msg2 : message),
protocol_trace tr ->
v1 < v2 ->
trigger_message_global tr j v1 msg1 ->
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <= b_height (get_block msg2)                                             
  intros H_ass tr j v1 v2 msg1 msg2 H_prot H_past H_trigger1 H_trigger2.H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1, msg2: message
H_prot: protocol_trace tr
H_past: v1 < v2
H_trigger1: trigger_message_global tr j v1 msg1
H_trigger2: trigger_message_global tr j v2 msg2
b_height (get_block msg1) <= b_height (get_block msg2)
  generalize dependent msg2.H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < v2
H_trigger1: trigger_message_global tr j v1 msg1
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <= b_height (get_block msg2)
  induction v2 as [|v2 IHv2]; intros.H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < 0
H_trigger1: trigger_message_global tr j v1 msg1
msg2: message
H_trigger2: trigger_message_global tr j 0 msg2
b_height (get_block msg1) <= b_height (get_block msg2)
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
IHv2: v1 < v2 ->
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
b_height (get_block msg1) <= b_height (get_block msg2)
  -H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < 0
H_trigger1: trigger_message_global tr j v1 msg1
msg2: message
H_trigger2: trigger_message_global tr j 0 msg2
b_height (get_block msg1) <= b_height (get_block msg2) inversion H_past. 
  -H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
IHv2: v1 < v2 ->
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
b_height (get_block msg1) <= b_height (get_block msg2) assert (v1 < v2 \/ v1 = v2) by lia.H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
IHv2: v1 < v2 ->
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 < v2 \/ v1 = v2
b_height (get_block msg1) <= b_height (get_block msg2)
    destruct H.H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
IHv2: v1 < v2 ->
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 < v2
b_height (get_block msg1) <= b_height (get_block msg2)
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
IHv2: v1 < v2 ->
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 = v2
b_height (get_block msg1) <= b_height (get_block msg2)
    assert (H_useful := trigger_message_past_exists_global).H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
IHv2: v1 < v2 ->
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 < v2
H_useful: forall (tr : GTrace) (i v : nat)
  (msg : message),
protocol_trace tr ->
trigger_message_global tr i v msg ->
forall v' : nat,
v' <= v ->
exists msg' : message,
  trigger_message_global tr i v' msg'
b_height (get_block msg1) <= b_height (get_block msg2)
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
IHv2: v1 < v2 ->
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 = v2
b_height (get_block msg1) <= b_height (get_block msg2) 
    spec H_useful tr j (S v2) msg2 H_prot H_trigger2 v2.H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
IHv2: v1 < v2 ->
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 < v2
H_useful: v2 <= S v2 ->
exists msg' : message,
  trigger_message_global tr j v2 msg'
b_height (get_block msg1) <= b_height (get_block msg2)
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
IHv2: v1 < v2 ->
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 = v2
b_height (get_block msg1) <= b_height (get_block msg2) spec H_useful.H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
IHv2: v1 < v2 ->
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 < v2
H_useful: v2 <= S v2 ->
exists msg' : message,
  trigger_message_global tr j v2 msg'
v2 <= S v2
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
IHv2: v1 < v2 ->
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 < v2
H_useful: exists msg' : message,
  trigger_message_global tr j v2 msg'
b_height (get_block msg1) <= b_height (get_block msg2)
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
IHv2: v1 < v2 ->
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 = v2
b_height (get_block msg1) <= b_height (get_block msg2) lia.H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
IHv2: v1 < v2 ->
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 < v2
H_useful: exists msg' : message,
  trigger_message_global tr j v2 msg'
b_height (get_block msg1) <= b_height (get_block msg2)
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
IHv2: v1 < v2 ->
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 = v2
b_height (get_block msg1) <= b_height (get_block msg2)
    destruct H_useful as [msg2' H_trigger2'].H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
IHv2: v1 < v2 ->
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 < v2
msg2': message
H_trigger2': trigger_message_global tr j v2 msg2'
b_height (get_block msg1) <= b_height (get_block msg2)
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
IHv2: v1 < v2 ->
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 = v2
b_height (get_block msg1) <= b_height (get_block msg2)
    spec IHv2 H msg2' H_trigger2'.H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 < v2
msg2': message
H_trigger2': trigger_message_global tr j v2 msg2'
IHv2: b_height (get_block msg1) <=
b_height (get_block msg2')
b_height (get_block msg1) <= b_height (get_block msg2)
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
IHv2: v1 < v2 ->
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 = v2
b_height (get_block msg1) <= b_height (get_block msg2)
    assert (H_useful := trigger_message_view_morphism_step_global).H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 < v2
msg2': message
H_trigger2': trigger_message_global tr j v2 msg2'
IHv2: b_height (get_block msg1) <=
b_height (get_block msg2')
H_useful: trigger_message_next_view_PrepareBlock_same_block_global ->
forall (tr : GTrace) (j v1 : nat)
  (msg1 msg2 : message),
protocol_trace tr ->
trigger_message_global tr j v1 msg1 ->
trigger_message_global tr j (S v1) msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
b_height (get_block msg1) <= b_height (get_block msg2)
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
IHv2: v1 < v2 ->
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 = v2
b_height (get_block msg1) <= b_height (get_block msg2)
    spec H_useful H_ass tr j v2 msg2' msg2 H_prot H_trigger2'.H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 < v2
msg2': message
H_trigger2': trigger_message_global tr j v2 msg2'
IHv2: b_height (get_block msg1) <=
b_height (get_block msg2')
H_useful: trigger_message_global tr j (S v2) msg2 ->
b_height (get_block msg2') <=
b_height (get_block msg2)
b_height (get_block msg1) <= b_height (get_block msg2)
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
IHv2: v1 < v2 ->
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 = v2
b_height (get_block msg1) <= b_height (get_block msg2) spec H_useful H_trigger2.H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 < v2
msg2': message
H_trigger2': trigger_message_global tr j v2 msg2'
IHv2: b_height (get_block msg1) <=
b_height (get_block msg2')
H_useful: b_height (get_block msg2') <=
b_height (get_block msg2)
b_height (get_block msg1) <= b_height (get_block msg2)
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
IHv2: v1 < v2 ->
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 = v2
b_height (get_block msg1) <= b_height (get_block msg2) lia.H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v1, v2: nat
msg1: message
H_prot: protocol_trace tr
H_past: v1 < S v2
H_trigger1: trigger_message_global tr j v1 msg1
IHv2: v1 < v2 ->
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
H: v1 = v2
b_height (get_block msg1) <= b_height (get_block msg2)
    subst.H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v2: nat
msg1: message
H_prot: protocol_trace tr
IHv2: v2 < v2 ->
forall msg2 : message,
trigger_message_global tr j v2 msg2 ->
b_height (get_block msg1) <=
b_height (get_block msg2)
H_trigger1: trigger_message_global tr j v2 msg1
H_past: v2 < S v2
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
b_height (get_block msg1) <= b_height (get_block msg2) clear IHv2.H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
j, v2: nat
msg1: message
H_prot: protocol_trace tr
H_trigger1: trigger_message_global tr j v2 msg1
H_past: v2 < S v2
msg2: message
H_trigger2: trigger_message_global tr j (S v2) msg2
b_height (get_block msg1) <= b_height (get_block msg2)
    now apply trigger_message_view_morphism_step_global with tr j v2. 
Qed.

Final cases of precommit stage height injectivity

Finally, we show the case of the precommit stage height injectivity proof when the parent and child block reach prepare stage in the same view. We extract the two symmetric cases in which b1 and b2 reach prepare stage in v1 and v2, and v1 <> v2.

Lemma precommit_now_height_injective_symmetric :
  exists_max_prepare_height_in_view_global ->
  at_least_second_highest -> 
  trigger_message_next_view_PrepareBlock_same_block_global -> 
  forall (tr : GTrace), protocol_trace tr ->
    forall (i : nat) (n m : node),
      node_view (fst (tr i) n) < node_view (fst (tr i) m) - 1 -> 
      In n participants ->
      In m participants ->
      forall (b1 b2 : block),
        b1 <> b2 -> 
        precommit_stage_now tr i n b1 ->
        precommit_stage_now tr i m b2 -> 
        b_height b1 = b_height b2 ->
        False.exists_max_prepare_height_in_view_global ->
at_least_second_highest ->
trigger_message_next_view_PrepareBlock_same_block_global ->
forall tr : GTrace,
protocol_trace tr ->
forall (i : nat) (n m : node),
node_view (fst (tr i) n) <
node_view (fst (tr i) m) - 1 ->
In n participants ->
In m participants ->
forall b1 b2 : block,
b1 <> b2 ->
precommit_stage_now tr i n b1 ->
precommit_stage_now tr i m b2 ->
b_height b1 = b_height b2 -> False
Proof.exists_max_prepare_height_in_view_global ->
at_least_second_highest ->
trigger_message_next_view_PrepareBlock_same_block_global ->
forall tr : GTrace,
protocol_trace tr ->
forall (i : nat) (n m : node),
node_view (fst (tr i) n) <
node_view (fst (tr i) m) - 1 ->
In n participants ->
In m participants ->
forall b1 b2 : block,
b1 <> b2 ->
precommit_stage_now tr i n b1 ->
precommit_stage_now tr i m b2 ->
b_height b1 = b_height b2 -> False                          
  intros H_useful3 H_second H_ass tr H_prot i n m H_lt H_part_n.H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_lt: node_view (fst (tr i) n) <
node_view (fst (tr i) m) - 1
H_part_n: In n participants
In m participants ->
forall b1 b2 : block,
b1 <> b2 ->
precommit_stage_now tr i n b1 ->
precommit_stage_now tr i m b2 ->
b_height b1 = b_height b2 -> False
  intros H_part_m b1 b2 H_neq H_precommit1 H_precommit2 H_height.H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_lt: node_view (fst (tr i) n) <
node_view (fst (tr i) m) - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
False
  destruct H_precommit1 as [b_child1 [H_height1 [H_prepare1 H_prepare_child1]]].H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_lt: node_view (fst (tr i) n) <
node_view (fst (tr i) m) - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n)
  (node_view (fst (tr i) n)) b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n)
  (node_view (fst (tr i) n))
  b_child1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
False 
  destruct H_precommit2 as [b_child2 [H_height2 [H_prepare2 H_prepare_child2]]].H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_lt: node_view (fst (tr i) n) <
node_view (fst (tr i) m) - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n)
  (node_view (fst (tr i) n)) b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n)
  (node_view (fst (tr i) n))
  b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m)
  (node_view (fst (tr i) m)) b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m)
  (node_view (fst (tr i) m))
  b_child2
H_height: b_height b1 = b_height b2
False  

  remember (node_view (fst (tr i) n)) as v1;
    remember (node_view (fst (tr i) m)) as v2.H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
False 
  (* b2 must be higher than the trigger message in (v2 - 1), for view change from (v2 - 1) to v2 *)   
  assert (H_useful := past_view_trigger_message_lowest_block_global).H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_useful: trigger_message_next_view_PrepareBlock_same_block_global ->
forall (tr : GTrace) (i : nat) 
  (n : node) (p : nat) 
  (msg : message),
protocol_trace tr ->
In n participants ->
trigger_message_global tr i p msg ->
forall b : block,
prepare_stage_in_view_global tr i b (S p) ->
b_height b > b_height (get_block msg)
False
  spec H_useful H_ass tr i m (v2 - 1).H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_useful: forall msg : message,
protocol_trace tr ->
In m participants ->
trigger_message_global tr i (v2 - 1) msg ->
forall b : block,
prepare_stage_in_view_global tr i b
  (S (v2 - 1)) ->
b_height b > b_height (get_block msg)
False  

  (* Obtaining the trigger message in (v2 - 1) *) 
  assert (H_trigger := past_view_exists_trigger_message_global).H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_useful: forall msg : message,
protocol_trace tr ->
In m participants ->
trigger_message_global tr i (v2 - 1) msg ->
forall b : block,
prepare_stage_in_view_global tr i b
  (S (v2 - 1)) ->
b_height b > b_height (get_block msg)
H_trigger: forall tr : GTrace,
protocol_trace tr ->
forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
False
  spec H_trigger tr H_prot m i H_part_m (v2 - 1).H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_useful: forall msg : message,
protocol_trace tr ->
In m participants ->
trigger_message_global tr i (v2 - 1) msg ->
forall b : block,
prepare_stage_in_view_global tr i b
  (S (v2 - 1)) ->
b_height b > b_height (get_block msg)
H_trigger: v2 - 1 < node_view (fst (tr i) m) ->
exists msg : message,
  trigger_message_global tr i (v2 - 1) msg
False
  spec H_trigger.H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_useful: forall msg : message,
protocol_trace tr ->
In m participants ->
trigger_message_global tr i (v2 - 1) msg ->
forall b : block,
prepare_stage_in_view_global tr i b
  (S (v2 - 1)) ->
b_height b > b_height (get_block msg)
H_trigger: v2 - 1 < node_view (fst (tr i) m) ->
exists msg : message,
  trigger_message_global tr i (v2 - 1) msg
v2 - 1 < node_view (fst (tr i) m)
H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_useful: forall msg : message,
protocol_trace tr ->
In m participants ->
trigger_message_global tr i (v2 - 1) msg ->
forall b : block,
prepare_stage_in_view_global tr i b
  (S (v2 - 1)) ->
b_height b > b_height (get_block msg)
H_trigger: exists msg : message,
  trigger_message_global tr i (v2 - 1) msg
False lia.H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_useful: forall msg : message,
protocol_trace tr ->
In m participants ->
trigger_message_global tr i (v2 - 1) msg ->
forall b : block,
prepare_stage_in_view_global tr i b
  (S (v2 - 1)) ->
b_height b > b_height (get_block msg)
H_trigger: exists msg : message,
  trigger_message_global tr i (v2 - 1) msg
False
  destruct H_trigger as [msg_v2 H_trigger_v2].H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
H_useful: forall msg : message,
protocol_trace tr ->
In m participants ->
trigger_message_global tr i (v2 - 1) msg ->
forall b : block,
prepare_stage_in_view_global tr i b
  (S (v2 - 1)) ->
b_height b > b_height (get_block msg)
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
False
  spec H_useful msg_v2 H_prot H_part_m H_trigger_v2.H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: forall b : block,
prepare_stage_in_view_global tr i b
  (S (v2 - 1)) ->
b_height b > b_height (get_block msg_v2)
False
  replace (S (v2 - 1)) with v2 in H_useful by lia.H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: forall b : block,
prepare_stage_in_view_global tr i b v2 ->
b_height b > b_height (get_block msg_v2)
False
  spec H_useful b2.H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: prepare_stage_in_view_global tr i b2 v2 ->
b_height b2 > b_height (get_block msg_v2)
False
  unfold prepare_stage in H_prepare2.H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: prepare_stage_in_view_global tr i b2 v2 ->
b_height b2 > b_height (get_block msg_v2)
False 
  spec H_useful.H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: prepare_stage_in_view_global tr i b2 v2 ->
b_height b2 > b_height (get_block msg_v2)
prepare_stage_in_view_global tr i b2 v2
H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
False
  now apply prepare_stage_in_view_means_prepare_stage_in_view_global with m.H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
False 
  (* Now we have established that b2 is higher than the trigger message for (v2 - 1) *)
  (* We want to establish that b1 is lower than the trigger message for v1 *)
  (* Obtaining the trigger message for (S v1) *)
  assert (H_trigger2 := past_view_exists_trigger_message_global).H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
H_trigger2: forall tr : GTrace,
protocol_trace tr ->
forall (n : node) (i : nat),
In n participants ->
forall v_past : nat,
v_past < node_view (fst (tr i) n) ->
exists msg : message,
  trigger_message_global tr i v_past msg
False
  spec H_trigger2 tr H_prot m i H_part_m v1.H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
H_trigger2: v1 < node_view (fst (tr i) m) ->
exists msg : message,
  trigger_message_global tr i v1 msg
False
  spec H_trigger2.H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
H_trigger2: v1 < node_view (fst (tr i) m) ->
exists msg : message,
  trigger_message_global tr i v1 msg
v1 < node_view (fst (tr i) m)
H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
H_trigger2: exists msg : message,
  trigger_message_global tr i v1 msg
False lia.H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
H_trigger2: exists msg : message,
  trigger_message_global tr i v1 msg
False
  destruct H_trigger2 as [msg_v1 H_trigger1].H_useful3: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
False

  (* Obtaining the highest prepare height for v1 *) 
  spec H_useful3 tr i v1 H_prot.H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
H_useful3: (exists b : block,
   prepare_stage_in_view_global tr i b v1) ->
exists h : nat,
  is_max_prepare_height_in_view_global tr
    i h v1
False
  spec H_useful3.H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
H_useful3: (exists b : block,
   prepare_stage_in_view_global tr i b v1) ->
exists h : nat,
  is_max_prepare_height_in_view_global tr
    i h v1
exists b : block,
  prepare_stage_in_view_global tr i b v1
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
H_useful3: exists h : nat,
  is_max_prepare_height_in_view_global tr
    i h v1
False
  (* Showing that a global prepare stage block exists *)
  exists b1.H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
H_useful3: (exists b : block,
   prepare_stage_in_view_global tr i b v1) ->
exists h : nat,
  is_max_prepare_height_in_view_global tr
    i h v1
prepare_stage_in_view_global tr i b1 v1
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
H_useful3: exists h : nat,
  is_max_prepare_height_in_view_global tr
    i h v1
False now apply prepare_stage_in_view_means_prepare_stage_in_view_global with n.H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
H_useful3: exists h : nat,
  is_max_prepare_height_in_view_global tr
    i h v1
False
  destruct H_useful3 as [h_max H_highest_v1].H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
False 

  (* Now we want to say that msg_v1 <= msg_v2 *)
  assert (b_height (get_block msg_v1) <= b_height (get_block msg_v2))
   by (apply trigger_message_view_morphism_global with tr i v1 (v2-1); try assumption; lia).H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
False
  
  (* Next we want to say that b_height b1 < b_height (get_block msg_v1) *)  
  assert (H_prepare1_global : prepare_stage_in_view_global tr i b1 v1).H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
prepare_stage_in_view_global tr i b1 v1
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
False
  {H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
prepare_stage_in_view_global tr i b1 v1 now apply prepare_stage_in_view_means_prepare_stage_in_view_global with n. }H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
False 
  assert (b_height b1 < b_height (get_block msg_v1)).H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
b_height b1 < b_height (get_block msg_v1)
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H0: b_height b1 < b_height (get_block msg_v1)
False
  {H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
b_height b1 < b_height (get_block msg_v1) assert (H_disj := is_max_prepare_height_in_view_disj_global).H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_disj: forall (tr : GTrace) (i h p : nat),
protocol_trace tr ->
is_max_prepare_height_in_view_global tr i h p ->
forall b : block,
prepare_stage_in_view_global tr i b p ->
b_height b = h \/ b_height b < h
b_height b1 < b_height (get_block msg_v1)
    spec H_disj tr i h_max v1 H_prot H_highest_v1 b1 H_prepare1_global.H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_disj: b_height b1 = h_max \/ b_height b1 < h_max
b_height b1 < b_height (get_block msg_v1) 

    destruct H_disj as [H_false | H_true].H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_false: b_height b1 = h_max
b_height b1 < b_height (get_block msg_v1)
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_true: b_height b1 < h_max
b_height b1 < b_height (get_block msg_v1)
    -H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_false: b_height b1 = h_max
b_height b1 < b_height (get_block msg_v1) destruct H_highest_v1 as [_ H_highest_v1].H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H_highest_v1: forall b : block,
prepare_stage_in_view_global tr i b v1 ->
b_height b <= h_max
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_false: b_height b1 = h_max
b_height b1 < b_height (get_block msg_v1)
      spec H_highest_v1 b_child1.H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_false: b_height b1 = h_max
H_highest_v1: prepare_stage_in_view_global tr i
  b_child1 v1 ->
b_height b_child1 <= h_max
b_height b1 < b_height (get_block msg_v1)
      spec H_highest_v1.H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_false: b_height b1 = h_max
H_highest_v1: prepare_stage_in_view_global tr i
  b_child1 v1 ->
b_height b_child1 <= h_max
prepare_stage_in_view_global tr i b_child1 v1
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_false: b_height b1 = h_max
H_highest_v1: b_height b_child1 <= h_max
b_height b1 < b_height (get_block msg_v1)
      now apply prepare_stage_in_view_means_prepare_stage_in_view_global with n.H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_false: b_height b1 = h_max
H_highest_v1: b_height b_child1 <= h_max
b_height b1 < b_height (get_block msg_v1)
      assert (b_height b_child1 = S (b_height b1)).H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_false: b_height b1 = h_max
H_highest_v1: b_height b_child1 <= h_max
b_height b_child1 = S (b_height b1)
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_false: b_height b1 = h_max
H_highest_v1: b_height b_child1 <= h_max
H0: b_height b_child1 = S (b_height b1)
b_height b1 < b_height (get_block msg_v1)
      {H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_false: b_height b1 = h_max
H_highest_v1: b_height b_child1 <= h_max
b_height b_child1 = S (b_height b1) rewrite <- H_height1.H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_false: b_height b1 = h_max
H_highest_v1: b_height b_child1 <= h_max
b_height b_child1 = S (b_height (parent_of b_child1)) symmetry; apply parent_block_height. }H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_false: b_height b1 = h_max
H_highest_v1: b_height b_child1 <= h_max
H0: b_height b_child1 = S (b_height b1)
b_height b1 < b_height (get_block msg_v1)
      lia. 
    -H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_true: b_height b1 < h_max
b_height b1 < b_height (get_block msg_v1) destruct H_trigger1 as [H_normal1 | H_timeout1].H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_normal1: normal_trigger_message_global tr i v1
  msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_true: b_height b1 < h_max
b_height b1 < b_height (get_block msg_v1)
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_timeout1: timeout_trigger_message_global tr i v1
  msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_true: b_height b1 < h_max
b_height b1 < b_height (get_block msg_v1)
      + (* In the normal case *)H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_normal1: normal_trigger_message_global tr i v1
  msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_true: b_height b1 < h_max
b_height b1 < b_height (get_block msg_v1)
        assert (H_highest := normal_trigger_message_highest_global).H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_normal1: normal_trigger_message_global tr i v1
  msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_true: b_height b1 < h_max
H_highest: forall (tr : GTrace) (i p : nat)
  (msg : message) (h_max : nat),
protocol_trace tr ->
normal_trigger_message_global tr i p msg ->
is_max_prepare_height_in_view_global tr i
  h_max p ->
b_height (get_block msg) = h_max
b_height b1 < b_height (get_block msg_v1)
        spec H_highest tr i v1 msg_v1 h_max H_prot H_normal1 H_highest_v1.H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_normal1: normal_trigger_message_global tr i v1
  msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_true: b_height b1 < h_max
H_highest: b_height (get_block msg_v1) = h_max
b_height b1 < b_height (get_block msg_v1)  
        lia.
      + (* In the timeout case *)H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_timeout1: timeout_trigger_message_global tr i v1
  msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_true: b_height b1 < h_max
b_height b1 < b_height (get_block msg_v1)
        assert (H_second' := timeout_trigger_message_highest_or_second_highest_global).H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_timeout1: timeout_trigger_message_global tr i v1
  msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_true: b_height b1 < h_max
H_second': at_least_second_highest ->
forall (tr : GTrace) (i p : nat)
  (msg : message) (h_max : nat),
protocol_trace tr ->
timeout_trigger_message_global tr i p msg ->
is_max_prepare_height_in_view_global tr i
  h_max p ->
b_height (get_block msg) = h_max \/
b_height (get_block msg) = h_max - 1
b_height b1 < b_height (get_block msg_v1)
        spec H_second' H_second tr i v1 msg_v1 h_max H_prot H_timeout1.H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_timeout1: timeout_trigger_message_global tr i v1
  msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_true: b_height b1 < h_max
H_second': is_max_prepare_height_in_view_global tr i
  h_max v1 ->
b_height (get_block msg_v1) = h_max \/
b_height (get_block msg_v1) = h_max - 1
b_height b1 < b_height (get_block msg_v1) spec H_second' H_highest_v1.H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_timeout1: timeout_trigger_message_global tr i v1
  msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H_true: b_height b1 < h_max
H_second': b_height (get_block msg_v1) = h_max \/
b_height (get_block msg_v1) = h_max - 1
b_height b1 < b_height (get_block msg_v1)
        lia. }H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view 
  (fst (tr i) n) v1 b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n) v1 b_child1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view 
  (fst (tr i) m) v2 b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m) v2 b_child2
H_height: b_height b1 = b_height b2
msg_v2: message
H_trigger_v2: trigger_message_global tr i 
  (v2 - 1) msg_v2
H_useful: b_height b2 > b_height (get_block msg_v2)
msg_v1: message
H_trigger1: trigger_message_global tr i v1 msg_v1
h_max: nat
H_highest_v1: is_max_prepare_height_in_view_global tr
  i h_max v1
H: b_height (get_block msg_v1) <=
b_height (get_block msg_v2)
H_prepare1_global: prepare_stage_in_view_global tr i
  b1 v1
H0: b_height b1 < b_height (get_block msg_v1)
False
  lia.
Qed.

Middle case.

Definition precommit_now_height_injective_middle :=
  forall (tr : GTrace),
    protocol_trace tr ->
    forall (i : nat) (n m : node),
      node_view (fst (tr i) n) = node_view (fst (tr i) m) - 1 -> 
      In n participants ->
      In m participants ->
      forall (b1 b2 : block),
        b1 <> b2 -> 
        precommit_stage_now tr i n b1 ->
        precommit_stage_now tr i m b2 -> 
        b_height b1 = b_height b2 ->
        False.

We use the helper lemma above to discharge two cases in the final proof, and we use same view prepare stage height injectivity to discharge the middle case, in which v1 = v2.

Lemma precommit_now_height_injective :
  exists_max_prepare_height_in_view_global ->
  at_least_second_highest -> 
  trigger_message_next_view_PrepareBlock_same_block_global -> 
  precommit_now_height_injective_middle -> 
  forall (tr : GTrace), protocol_trace tr ->
    forall (i : nat) (n m : node),
      In n participants ->
      In m participants ->
      forall (b1 b2 : block),
        b1 <> b2 -> 
        precommit_stage_now tr i n b1 ->
        precommit_stage_now tr i m b2 -> 
        b_height b1 = b_height b2 ->
        False.exists_max_prepare_height_in_view_global ->
at_least_second_highest ->
trigger_message_next_view_PrepareBlock_same_block_global ->
precommit_now_height_injective_middle ->
forall tr : GTrace,
protocol_trace tr ->
forall (i : nat) (n m : node),
In n participants ->
In m participants ->
forall b1 b2 : block,
b1 <> b2 ->
precommit_stage_now tr i n b1 ->
precommit_stage_now tr i m b2 ->
b_height b1 = b_height b2 -> False
Proof.exists_max_prepare_height_in_view_global ->
at_least_second_highest ->
trigger_message_next_view_PrepareBlock_same_block_global ->
precommit_now_height_injective_middle ->
forall tr : GTrace,
protocol_trace tr ->
forall (i : nat) (n m : node),
In n participants ->
In m participants ->
forall b1 b2 : block,
b1 <> b2 ->
precommit_stage_now tr i n b1 ->
precommit_stage_now tr i m b2 ->
b_height b1 = b_height b2 -> False                         
  intros H_max H_second H_ass H_mid tr H_prot i n m.H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
In n participants ->
In m participants ->
forall b1 b2 : block,
b1 <> b2 ->
precommit_stage_now tr i n b1 ->
precommit_stage_now tr i m b2 ->
b_height b1 = b_height b2 -> False
  intros H_part_n H_part_m b1 b2 H_neq H_precommit1 H_precommit2 H_height.H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
False
  remember (node_view (fst (tr i) n)) as v1;
    remember (node_view (fst (tr i) m)) as v2.H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
False
  assert (v1 < v2 - 1 \/ v1 = v2 - 1 \/ v1 > v2 - 1) by lia.H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H: v1 < v2 - 1 \/ v1 = v2 - 1 \/ v1 > v2 - 1
False 
  destruct H as [H_lt | [H_eq | H_gt]].H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
False
H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_eq: v1 = v2 - 1
False
H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_gt: v1 > v2 - 1
False
  -H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v1 < v2 - 1
False subst;
      now apply precommit_now_height_injective_symmetric with tr i n m b1 b2.
  -H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_eq: v1 = v2 - 1
False subst.H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
H_eq: node_view (fst (tr i) n) =
node_view (fst (tr i) m) - 1
False red in H_mid.H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: forall tr : GTrace,
protocol_trace tr ->
forall (i : nat) (n m : node),
node_view (fst (tr i) n) =
node_view (fst (tr i) m) - 1 ->
In n participants ->
In m participants ->
forall b1 b2 : block,
b1 <> b2 ->
precommit_stage_now tr i n b1 ->
precommit_stage_now tr i m b2 ->
b_height b1 = b_height b2 -> False
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
H_eq: node_view (fst (tr i) n) =
node_view (fst (tr i) m) - 1
False
    now apply H_mid with tr i n m b1 b2.
  -H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_gt: v1 > v2 - 1
False assert (v2 < v1 - 1 \/ v2 = v1 \/ v2 = v1 - 1) by lia.H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_gt: v1 > v2 - 1
H: v2 < v1 - 1 \/ v2 = v1 \/ v2 = v1 - 1
False
    clear H_gt.H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H: v2 < v1 - 1 \/ v2 = v1 \/ v2 = v1 - 1
False 
    destruct H as [H_lt | [H_eq1 | H_eq2]].H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v2 < v1 - 1
False
H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_eq1: v2 = v1
False
H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_eq2: v2 = v1 - 1
False
    +H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_lt: v2 < v1 - 1
False subst.H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
H_lt: node_view (fst (tr i) m) <
node_view (fst (tr i) n) - 1
False
      assert (b2 <> b1) by (apply not_eq_sym in H_neq; assumption).H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
H_lt: node_view (fst (tr i) m) <
node_view (fst (tr i) n) - 1
H: b2 <> b1
False
      symmetry in H_height.H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b2 = b_height b1
H_lt: node_view (fst (tr i) m) <
node_view (fst (tr i) n) - 1
H: b2 <> b1
False
      now apply precommit_now_height_injective_symmetric with tr i m n b2 b1.
    +H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_eq1: v2 = v1
False subst.H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
H_eq1: node_view (fst (tr i) m) =
node_view (fst (tr i) n)
False
      apply prepare_stage_same_view_height_injective
       with tr i n m b1 b2 (node_view (fst (tr i) n)); try assumption.H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
H_eq1: node_view (fst (tr i) m) =
node_view (fst (tr i) n)
prepare_stage_in_view (fst (tr i) n)
  (node_view (fst (tr i) n)) b1
H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
H_eq1: node_view (fst (tr i) m) =
node_view (fst (tr i) n)
prepare_stage_in_view (fst (tr i) m)
  (node_view (fst (tr i) n)) b2
    destruct H_precommit1 as [b_child1 [H_height1 [H_prepare1 H_prepare_child1]]].H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
b_child1: block
H_height1: parent_of b_child1 = b1
H_prepare1: prepare_stage_in_view (fst (tr i) n)
  (node_view (fst (tr i) n)) b1
H_prepare_child1: prepare_stage_in_view
  (fst (tr i) n)
  (node_view (fst (tr i) n))
  b_child1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
H_eq1: node_view (fst (tr i) m) =
node_view (fst (tr i) n)
prepare_stage_in_view (fst (tr i) n)
  (node_view (fst (tr i) n)) b1
H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
H_eq1: node_view (fst (tr i) m) =
node_view (fst (tr i) n)
prepare_stage_in_view (fst (tr i) m)
  (node_view (fst (tr i) n)) b2
    assumption.H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
H_eq1: node_view (fst (tr i) m) =
node_view (fst (tr i) n)
prepare_stage_in_view (fst (tr i) m)
  (node_view (fst (tr i) n)) b2
    destruct H_precommit2 as [b_child2 [H_height2 [H_prepare2 H_prepare_child2]]].H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view (fst (tr i) m)
  (node_view (fst (tr i) m)) b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m)
  (node_view (fst (tr i) m))
  b_child2
H_height: b_height b1 = b_height b2
H_eq1: node_view (fst (tr i) m) =
node_view (fst (tr i) n)
prepare_stage_in_view (fst (tr i) m)
  (node_view (fst (tr i) n)) b2
    rewrite <- H_eq1.H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
b_child2: block
H_height2: parent_of b_child2 = b2
H_prepare2: prepare_stage_in_view (fst (tr i) m)
  (node_view (fst (tr i) m)) b2
H_prepare_child2: prepare_stage_in_view
  (fst (tr i) m)
  (node_view (fst (tr i) m))
  b_child2
H_height: b_height b1 = b_height b2
H_eq1: node_view (fst (tr i) m) =
node_view (fst (tr i) n)
prepare_stage_in_view (fst (tr i) m)
  (node_view (fst (tr i) m)) b2 assumption.
    +H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
v1: nat
Heqv1: v1 = node_view (fst (tr i) n)
v2: nat
Heqv2: v2 = node_view (fst (tr i) m)
H_eq2: v2 = v1 - 1
False subst.H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: precommit_now_height_injective_middle
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
H_eq2: node_view (fst (tr i) m) =
node_view (fst (tr i) n) - 1
False
      unfold precommit_now_height_injective_middle in H_mid.H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: forall tr : GTrace,
protocol_trace tr ->
forall (i : nat) (n m : node),
node_view (fst (tr i) n) =
node_view (fst (tr i) m) - 1 ->
In n participants ->
In m participants ->
forall b1 b2 : block,
b1 <> b2 ->
precommit_stage_now tr i n b1 ->
precommit_stage_now tr i m b2 ->
b_height b1 = b_height b2 -> False
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
H_eq2: node_view (fst (tr i) m) =
node_view (fst (tr i) n) - 1
False
      assert (b2 <> b1) by (apply not_eq_sym in H_neq; assumption).H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: forall tr : GTrace,
protocol_trace tr ->
forall (i : nat) (n m : node),
node_view (fst (tr i) n) =
node_view (fst (tr i) m) - 1 ->
In n participants ->
In m participants ->
forall b1 b2 : block,
b1 <> b2 ->
precommit_stage_now tr i n b1 ->
precommit_stage_now tr i m b2 ->
b_height b1 = b_height b2 -> False
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b1 = b_height b2
H_eq2: node_view (fst (tr i) m) =
node_view (fst (tr i) n) - 1
H: b2 <> b1
False
      symmetry in H_height.H_max: exists_max_prepare_height_in_view_global
H_second: at_least_second_highest
H_ass: trigger_message_next_view_PrepareBlock_same_block_global
H_mid: forall tr : GTrace,
protocol_trace tr ->
forall (i : nat) (n m : node),
node_view (fst (tr i) n) =
node_view (fst (tr i) m) - 1 ->
In n participants ->
In m participants ->
forall b1 b2 : block,
b1 <> b2 ->
precommit_stage_now tr i n b1 ->
precommit_stage_now tr i m b2 ->
b_height b1 = b_height b2 -> False
tr: GTrace
H_prot: protocol_trace tr
i: nat
n, m: node
H_part_n: In n participants
H_part_m: In m participants
b1, b2: block
H_neq: b1 <> b2
H_precommit1: precommit_stage_now tr i n b1
H_precommit2: precommit_stage_now tr i m b2
H_height: b_height b2 = b_height b1
H_eq2: node_view (fst (tr i) m) =
node_view (fst (tr i) n) - 1
H: b2 <> b1
False
      now apply H_mid with tr i m n b2 b1.
Qed.